AIKIDO-2026-930855
keycloak-services is vulnerable to Privilege Escalation
85
High Risk
This Affects:
keycloak-servicesTL;DR
Dynamic Client Registration bearer-token authorization trusts resource_access role claims in the presented token without confirming the user actually holds those roles. A standard user can forge admin roles into their own token via a user property mapper and use them against the DCR endpoint to gain elevated client-registration privileges. The fix authorizes DCR from the user's real grants instead of unverified token role claims.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and allow standard users to obtain Initial Access Tokens or otherwise interact with Dynamic Client Registration.
Background info
keycloak-services is vulnerable to Privilege Escalation in versions 1.7.0 - 26.7.0.
How to fix this
Upgrade the org.keycloak:keycloak-services library to the patch version.
Links
GitHub Release
Other
access.redhat.com/errata/RHSA-2026:50846access.redhat.com/errata/RHSA-2026:50847access.redhat.com/errata/RHSA-2026:50848access.redhat.com/errata/RHSA-2026:50849access.redhat.com/security/cve/CVE-2026-16102bugzilla.redhat.com/show_bug.cgi?id=2501735
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.