{"id":"CVE-2026-109081","kind":"vulnerability","aliases":["CVE-2026-109081"],"related":[],"title":"Keycloak: Dynamic client registration lets attackers bloat realm tokens","description":"A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).","summary":"Keycloak's Dynamic Client Registration endpoint does not check authorization when it processes the deprecated defaultRoles field. An authenticated user with client creation rights or an Initial Access Token can add excessive roles to a realm's default roles, making every client's access tokens bloated and possibly causing a denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","keycloak","package","self-hosted"],"not_affected_if":["dcr-disabled","no-initial-access-tokens"],"how_to_check":"- Check the installed Keycloak version against the affected ranges in the NVD entry (unknown from the sources given)\n- Check whether Dynamic Client Registration is enabled and who holds client creation rights or Initial Access Tokens (unknown from the sources given)","fix":null,"status":"open","published_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:41:32+00:00","updated_at":"2026-11-06T06:41:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:41:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: Dynamic client registration lets attackers bloat realm tokens","impact":"medium","summary":"Keycloak's Dynamic Client Registration endpoint does not check authorization when it processes the deprecated defaultRoles field. An authenticated user with client creation rights or an Initial Access Token can add excessive roles to a realm's default roles, making every client's access tokens bloated and possibly causing a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Realm-wide token bloat degrades performance and memory, causing denial of service","analyst_note":"Find the affected and fixed Keycloak versions and whether the defaultRoles field is still active, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109081.","how_to_check":"- Check the installed Keycloak version against the affected ranges in the NVD entry (unknown from the sources given)\n- Check whether Dynamic Client Registration is enabled and who holds client creation rights or Initial Access Tokens (unknown from the sources given)","plain_action":"","needs_analyst":true,"not_affected_if":["dcr-disabled","no-initial-access-tokens"],"who_is_affected":"Organisations that run Keycloak as their identity provider and allow Dynamic Client Registration, or issue Initial Access Tokens, are exposed. Realms that do not expose the DCR endpoint, or where only trusted administrators can create clients, are less exposed. The sources do not name affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000739,"input_tokens":4256,"output_tokens":627,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109081':12A,15A '-2026':11A,14A 'access':49B,65B,108C,131C 'across':125C 'add':52B 'attack':6A,100C 'authent':40B,99C 'author':31B,91C 'bloat':7A,67B,130C 'caus':70B,123C 'check':30B 'client':3A,25B,43B,63B,83C,102C,124C 'configur':121C 'creation':44B,103C 'cve':10A,13A 'dcr':85C 'default':59B,119C 'defaultrol':37B,96C 'degrad':138C 'denial':72B,144C 'deprec':36B,95C 'dos':147C 'dynam':2A,24B,82C 'endpoint':27B,86C 'everi':62B 'excess':53B,113C 'field':38B,97C 'flaw':76C 'found':78C 'generat':129C 'host':21B 'iat':110C 'ident':16B 'initi':48B,107C 'inject':112C 'keycloak':1A,17B,22B,80C 'lead':141C 'let':5A 'make':61B 'memori':137C 'packag':18B 'perform':135C 'possibl':69B 'privileg':104C 'process':34B,93C 'proper':89C 'realm':8A,57B,117C,127C 'registr':4A,26B,84C 'result':133C 'right':45B 'role':54B,60B,114C,120C 'self':20B 'self-host':19B 'servic':74B,146C 'token':9A,50B,66B,109C,132C 'user':41B 'valid':90C","nicknames":[],"mitigations":[],"who_affected":"Organisations that run Keycloak as their identity provider and allow Dynamic Client Registration, or issue Initial Access Tokens, are exposed. Realms that do not expose the DCR endpoint, or where only trusted administrators can create clients, are less exposed. The sources do not name affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","keycloak","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-109081':12A,15A '-2026':11A,14A 'attack':6A 'bloat':7A 'client':3A 'cve':10A,13A 'dynam':2A 'keycloak':1A 'let':5A 'realm':8A 'registr':4A 'token':9A","search_b":"'access':49B,65B 'add':52B 'authent':40B 'author':31B 'bloat':67B 'caus':70B 'check':30B 'client':25B,43B,63B 'creation':44B 'default':59B 'defaultrol':37B 'denial':72B 'deprec':36B 'dynam':24B 'endpoint':27B 'everi':62B 'excess':53B 'field':38B 'host':21B 'ident':16B 'initi':48B 'keycloak':17B,22B 'make':61B 'packag':18B 'possibl':69B 'process':34B 'realm':57B 'registr':26B 'right':45B 'role':54B,60B 'self':20B 'self-host':19B 'servic':74B 'token':50B,66B 'user':41B","search_c":"'access':108C,131C 'across':125C 'attack':100C 'authent':99C 'author':91C 'bloat':130C 'caus':123C 'client':83C,102C,124C 'configur':121C 'creation':103C 'dcr':85C 'default':119C 'defaultrol':96C 'degrad':138C 'denial':144C 'deprec':95C 'dos':147C 'dynam':82C 'endpoint':86C 'excess':113C 'field':97C 'flaw':76C 'found':78C 'generat':129C 'iat':110C 'initi':107C 'inject':112C 'keycloak':80C 'lead':141C 'memori':137C 'perform':135C 'privileg':104C 'process':93C 'proper':89C 'realm':117C,127C 'registr':84C 'result':133C 'role':114C,120C 'servic':146C 'token':109C,132C 'valid':90C","first_public_at":"2026-11-06T06:16:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109081","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109081","severity":null,"published_at":"2026-11-06T06:16:39+00:00","modified_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}