AIKIDO-2026-732363
keycloak-services is vulnerable to Insufficient Session Expiration
65
Medium Risk
This Affects:
keycloak-servicesTL;DR
Keycloak's client registration service continues to honor a previously issued registration access token after an administrator disables the client. A remote holder of that token can re-enable the disabled client and reset its secret. This lets the attacker restore and take over a client that was intentionally shut off, regaining privileged API access. The fix invalidates registration access token operations for disabled clients.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and dynamic client registration with registration access tokens is enabled.
Background info
keycloak-services is vulnerable to Insufficient Session Expiration in versions 1.0.1.Final - 26.6.3.
How to fix this
Upgrade the org.keycloak:keycloak-services library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:30049access.redhat.com/errata/RHSA-2026:30050access.redhat.com/errata/RHSA-2026:30083access.redhat.com/errata/RHSA-2026:30084access.redhat.com/security/cve/CVE-2026-9705bugzilla.redhat.com/show_bug.cgi?id=2481878
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant