---
id: "CVE-2026-92857"
kind: "vulnerability"
aliases: ["CVE-2026-92857"]
title: "Keycloak: client registration flaw lets attackers forge identity tokens for other users"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "keycloak", "fixed": ["26.8.2"], "affected": "< 26.8.2 (lower bound unknown)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dynamic-client-registration", "keycloak", "oidc", "rhbk", "runtime", "self-hosted"]
not_affected_if: ["dcr-disabled", "dynamic-client-registration-disabled", "no-initial-access-tokens"]
published_at: "2026-11-05T18:17:10+00:00"
first_seen_at: "2026-11-05T18:40:10+00:00"
updated_at: "2026-11-05T18:42:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92857", "first_seen_at": "2026-11-05T18:40:10+00:00"}, {"source": "analyst", "url": "https://github.com/keycloak/keycloak/issues/54705", "first_seen_at": "2026-11-05T18:42:33+00:00", "cites": ["https://github.com/keycloak/keycloak/issues/54705", "https://hol.org/guard/security/cves/CVE-2026-92857-keycloak-services-keycloak-services-dcr-protocol", "https://github.com/keycloak/keycloak/releases"]}]
exploit_sources: []
---

# Keycloak: client registration flaw lets attackers forge identity tokens for other users

Keycloak's Dynamic Client Registration lets users with specific tokens register their own applications, and validation of those requests is flawed. An attacker can map their profile to protected claims such as sub or aud and get signed tokens that impersonate other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:keycloak affected < 26.8.2 (lower bound unknown) fixed 26.8.2

## How to check

Run kc.sh --version (or check the admin console) and compare with 26.8.2. Then check whether Dynamic Client Registration is reachable: look at the realm's Client registration policies and at who holds initial access tokens or registration tokens. The default-allowed DCR protocol mappers (user property/attribute mappers) are what write the reserved sub and aud claims.

## Fix

Upgrade Keycloak to 26.8.2 (release notes list CVE-2026-92857 under security fixes). Issue #54705 is also labeled for 26.6.8 and 26.4.17 backports; check those releases are published before relying on them.

## Timeline

- 2026-11-05T18:40:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92857
- 2026-11-05T18:42:33+00:00 analyst https://github.com/keycloak/keycloak/issues/54705 — Fix 26.8.2 from Keycloak release notes + issue #54705 (labels also 26.6.8, 26.4.17). NVD page empty; affected lower bound and exact DCR preconditions (iat holders per Red Hat title) not in vendor text. Red Hat says no mitigation. Not known exploited; no PoC seen.

## Documents

- [advisory] keycloak #54705 CVE-2026-92857 DCR protocol mapper writes reserved sub and aud claims https://github.com/keycloak/keycloak/issues/54705
- [describes] HOL Guard record CVE-2026-92857 (Red Hat CVE text) https://hol.org/guard/security/cves/CVE-2026-92857-keycloak-services-keycloak-services-dcr-protocol
- [fix] Keycloak 26.8.2 release notes (security fixes) https://github.com/keycloak/keycloak/releases

## From the sources

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_