AIKIDO-2026-746025

TL;DR

Dynamic Client Registration's allowed-protocol-mapper-type policy only re-validates a mapper's type when its configuration changes. An attacker can register an allowed mapper and later swap its type to a forbidden, high-privilege one while leaving the configuration untouched, bypassing the type restriction. The fix re-validates the mapper type on every update, not only when configuration fields change.