{"id":"CVE-2026-92857","kind":"vulnerability","aliases":["CVE-2026-92857"],"related":[],"title":"Keycloak: client registration flaw lets attackers forge identity tokens for other users","description":"Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.","summary":"Keycloak's Dynamic Client Registration lets users with specific tokens register their own applications, and validation of those requests is flawed. An attacker can map their profile to protected claims such as sub or aud and get signed tokens that impersonate other users.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak","fixed":["26.8.2"],"affected":"< 26.8.2 (lower bound unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["dynamic-client-registration","keycloak","oidc","rhbk","runtime","self-hosted"],"not_affected_if":["dcr-disabled","dynamic-client-registration-disabled","no-initial-access-tokens"],"how_to_check":"Run kc.sh --version (or check the admin console) and compare with 26.8.2. Then check whether Dynamic Client Registration is reachable: look at the realm's Client registration policies and at who holds initial access tokens or registration tokens. The default-allowed DCR protocol mappers (user property/attribute mappers) are what write the reserved sub and aud claims.","fix":"Upgrade Keycloak to 26.8.2 (release notes list CVE-2026-92857 under security fixes). Issue #54705 is also labeled for 26.6.8 and 26.4.17 backports; check those releases are published before relying on them.","status":"open","published_at":"2026-11-05T18:17:10+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","triaged_at":"2026-11-05T18:40:29+00:00","updated_at":"2026-11-05T18:42:33+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T18:40:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: client registration flaw lets attackers forge identity tokens for other users","impact":"high","summary":"Keycloak's Dynamic Client Registration lets users with specific tokens register their own applications, and validation of those requests is flawed. An attacker can map their profile to protected claims such as sub or aud and get signed tokens that impersonate other users.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["keycloak","self-hosted","oidc"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker impersonates other users via forged signed tokens","analyst_note":"Confirm affected and fixed Keycloak version ranges and the exact token/config preconditions from the NVD entry or the Keycloak security advisory.","how_to_check":"- Check the Keycloak version with `kc.sh --version` or the admin console footer and compare it with the fixed versions below.\n- Review whether Dynamic Client Registration is enabled and who holds initial access or registration tokens.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["dynamic-client-registration-disabled"],"who_is_affected":"Deployments of Keycloak that enable Dynamic Client Registration and issue registration tokens to users are the exposed systems. Services that trust Keycloak-signed tokens for identity are the ones at risk of impersonation. Instances without Dynamic Client Registration or without registration-capable tokens can likely skip it, but the sources do not confirm the exact preconditions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4294,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected and fixed Keycloak version ranges and the exact token/config preconditions from the NVD entry or the Keycloak security advisory.","search":"'-2026':14A,17A '-92857':15A,18A 'access':160C 'allow':82C,101C,150C 'appear':142C 'applic':44B,91C,108C 'attack':6A,53B,103C,133C,152C 'aud':65B,131C 'audienc':130C 'claim':60B 'client':2A,22B,34B,78C 'could':149C 'creat':105C 'cve':13A,16A 'detail':119C 'differ':146C 'dynam':21B,33B,77C 'dynamic-client-registr':20B 'featur':80C 'field':122C 'flaw':4A,51B,93C 'forg':7A,110C 'gain':158C 'generat':135C 'get':67B 'host':30B 'id':126C 'ident':8A,111C,169C 'imperson':71B,154C 'inform':112C 'intend':129C 'keycloak':1A,19A,24B,31B,74C,96C 'let':5A,36B 'like':123C 'make':140C 'malici':107C 'map':55B,114C 'oidc':25B 'profil':57B,118C 'protect':59B,121C 'provid':75C 'regist':41B,88C 'registr':3A,23B,35B,79C,99C 'reli':164C 'request':49B,100C 'rhbk':26B 'runtim':27B 'secur':137C 'self':29B 'self-host':28B 'servic':162C 'sign':68B,136C 'specif':39B,85C 'sub':63B,127C 'token':9A,40B,69B,86C,138C,167C 'unauthor':159C 'user':12A,37B,73B,83C,117C,125C,147C,156C 'valid':46B,97C 'verif':170C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Keycloak (and Red Hat build of Keycloak, per Red Hat's CVE record) where Dynamic Client Registration is available to someone holding an initial access token. That person can register a client whose protocol mapper writes the reserved sub or aud claims, so the realm signs tokens that name another user. Teams that do not use DCR, or that issue no initial access tokens, are much less exposed. The affected lower bound is not stated in the sources I read.","tier":"B","verified":{"fix":{"at":"2026-11-05T18:42:33Z","by":"analyst","doc":"https://github.com/keycloak/keycloak/issues/54705","run_id":1817}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["keycloak"],"ptokens":["keycloak"],"labels":["dynamicclientregistration","high","keycloak","oidc","rhbk","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92857","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92857","severity":null,"published_at":"2026-11-05T18:17:10+00:00","modified_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","fetched_at":"2026-11-05T18:40:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92857:1817","url":"https://github.com/keycloak/keycloak/releases","severity":null,"published_at":"2026-11-05T18:42:33+00:00","modified_at":"2026-11-05T18:42:33+00:00","first_seen_at":"2026-11-05T18:42:33+00:00","fetched_at":"2026-11-05T18:42:33+00:00","note":"Fix 26.8.2 from Keycloak release notes + issue #54705 (labels also 26.6.8, 26.4.17). NVD page empty; affected lower bound and exact DCR preconditions (iat holders per Red Hat title) not in vendor text. Red Hat says no mitigation. Not known exploited; no PoC seen.","cites":["https://github.com/keycloak/keycloak/releases","https://github.com/keycloak/keycloak/issues/54705","https://hol.org/guard/security/cves/CVE-2026-92857-keycloak-services-keycloak-services-dcr-protocol"]}],"documents":[{"id":78346,"url":"https://github.com/keycloak/keycloak/releases","title":"Keycloak 26.8.2 release notes (security fixes)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":78884,"url":"https://github.com/keycloak/keycloak/issues/54705","title":"keycloak #54705 CVE-2026-92857 DCR protocol mapper writes reserved sub and aud claims","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78885,"url":"https://hol.org/guard/security/cves/CVE-2026-92857-keycloak-services-keycloak-services-dcr-protocol","title":"HOL Guard record CVE-2026-92857 (Red Hat CVE text)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}