---
id: "CVE-2026-109081"
page: "https://infrastack.ai/live/CVE-2026-109081"
kind: "vulnerability"
aliases: ["CVE-2026-109081"]
title: "Keycloak: Dynamic client registration lets attackers bloat realm tokens"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["identity", "keycloak", "package", "self-hosted"]
not_affected_if: ["dcr-disabled", "no-initial-access-tokens"]
published_at: "2026-11-06T06:16:39+00:00"
first_seen_at: "2026-11-06T06:40:11+00:00"
updated_at: "2026-11-06T06:41:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109081", "first_seen_at": "2026-11-06T06:40:11+00:00"}]
exploit_sources: []
---

# Keycloak: Dynamic client registration lets attackers bloat realm tokens

Link for people: https://infrastack.ai/live/CVE-2026-109081 (this .md is for agents)

Keycloak's Dynamic Client Registration endpoint does not check authorization when it processes the deprecated defaultRoles field. An authenticated user with client creation rights or an Initial Access Token can add excessive roles to a realm's default roles, making every client's access tokens bloated and possibly causing a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Keycloak version against the affected ranges in the NVD entry (unknown from the sources given)
- Check whether Dynamic Client Registration is enabled and who holds client creation rights or Initial Access Tokens (unknown from the sources given)

## Timeline

- 2026-11-06T06:40:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109081

## From the sources

A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_