CVE-2026-92857

Full vulnerability record from the local CVENow database.

Description

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.

Severity

HIGH

CVSS score

8.1 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-05 18:17:10.887000

Last modified

2026-11-05 18:17:11.013000

View original CVE JSON

{
  "id": "CVE-2026-92857",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T18:17:10.887",
  "lastModified": "2026-11-05T18:17:11.013",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat Build of Keycloak",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "keycloak/rhbk-openshift-rhel9",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Build of Keycloak",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "keycloak-services",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Build of Keycloak",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhbk/keycloak-rhel9",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat Single Sign-On 7",
          "defaultStatus": "unaffected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "keycloak-services",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-92857",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535817",
      "source": "[email protected]"
    }
  ]
}