What happened
A vulnerability has been identified in Keycloak, specifically within the Dynamic Client Registration (DCR) endpoint. The flaw involves improper validation of authorization when handling the deprecated defaultRoles field. An attacker with authenticated client creation privileges or possession of an Initial Access Token (IAT) can exploit this weakness to inject excessive roles into the realm’s default roles configuration. This injection results in clients across the realm generating excessively large access tokens, which can cause performance and memory degradation. If exploited sufficiently, this can lead to a Denial of Service (DoS). The attack can be carried out remotely over a network; it requires no user interaction but does demand that the attacker already has privileged access to the affected system. The vulnerability’s conditions enable direct exploitation through exposed network services, without any intermediary steps from a user, focusing mitigation efforts on network access control and patching to prevent attack vectors. The severity of this flaw is classified as medium, with a CVSS score of 6.8. The weakness involves CWE-862 and affects the Red Hat build of Keycloak versions prior to 26.6.8-2. A fix has been released and should be applied promptly to mitigate this issue. For affected deployments, the vulnerability’s impact lies solely in the potential for resource exhaustion and service disruption due to crafted role injections. It is advisable for organisations to consult the vendor’s advisory for details on fixed versions and consider mitigation strategies alongside patching efforts. The scope and specifics of this vulnerability may evolve as further analysis continues. Who is affected Organisations running the Red Hat build of Keycloak versions earlier than 26.6.8-2 are affected by this vulnerability. This includes systems where the Dynamic Client Registration (DCR) endpoint is accessible over the network and where the involved account privileges are granted to client management roles or higher. Systems with network exposure to the DCR service that permit authenticated creation of clients with defaultRoles modifications are vulnerable. No other dependencies or configurations are explicitly identified as contributing to the affected components at this stage. Since the vulnerability relies on privilege and network reachability, affected environments include those with exposed services and insufficient access controls or segmentation. No specific references are available to indicate broader impacts beyond the described scope. Recommended actions
Apply the available fix provided by the vendor to address the vulnerability. Restrict network access to the Keycloak services, ensuring that only trusted sources can reach the DCR endpoint. Monitor logs for unauthorised or abnormal client registration activities, especially those indicating role injection attempts. Review privilege settings for accounts with client creation rights, removing unnecessary permissions where possible.
