CVE-2026-16102: Keycloak Auth Bypass Vulnerability

CVE-2026-16102 Overview

CVE-2026-16102 is a broken access control flaw [CWE-284] in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to validate the claim path used by User Property mappers. An attacker with a standard user account and a limited Initial Access Token can write values to sensitive internal claim locations. This lets the attacker forge administrative roles in their access token, take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

Critical Impact
An authenticated low-privilege attacker can escalate to realm administrator by injecting forged role claims through User Property mappers registered via DCR.

Affected Products

Red Hat build of Keycloak (see Red Hat Security Advisories RHSA-2026:50846 through RHSA-2026:50849)
Red Hat Single Sign-On distributions relying on the vulnerable DCR default policy
Upstream Keycloak deployments exposing Dynamic Client Registration with default mapper validation

Discovery Timeline

2026-08-05 - CVE-2026-16102 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-16102

Vulnerability Analysis

Keycloak's Dynamic Client Registration lets clients self-register protocol mappers, including User Property mappers that project user attributes into issued tokens. The default DCR policy restricts which mappers can be created but does not validate the destination claim path those mappers write to. An attacker holding a valid Initial Access Token can register a client whose User Property mapper targets a privileged claim location such as realm_access.roles or resource_access. When that client issues a token, the mapper injects attacker-controlled values into claims that Keycloak and downstream relying parties treat as authoritative for authorization decisions.

Once a forged administrative role appears in a valid, Keycloak-signed access token, the attacker can invoke administrative REST endpoints, modify other clients, and read client secrets across the realm.

Root Cause

The root cause is missing authorization enforcement on the claim path parameter of User Property mappers during Dynamic Client Registration. The DCR policy validates the mapper type but not the target claim location, so a caller can route arbitrary user attributes into internal, security-critical claims that should be reserved for the server's role and permission mapping logic.

Attack Vector

Exploitation requires network access to the Keycloak DCR endpoint, a standard user account, and a limited Initial Access Token. The attacker registers a new client via POST /realms/{realm}/clients-registrations/default and includes a User Property mapper whose configuration writes a controlled value into a role-bearing claim. The attacker then authenticates through the newly registered client and receives an access token that carries forged administrative roles. Because the token is signed by the realm, all relying parties, including Keycloak's own admin API, accept the elevated claims.

The vulnerability requires only low privileges, no user interaction, and yields high confidentiality and integrity impact across the realm. Refer to the Red Hat CVE-2026-16102 Information page and Red Hat Bug Report #2501735 for additional technical background.

Detection Methods for CVE-2026-16102

Indicators of Compromise

Dynamic Client Registration events creating clients with User Property protocol mappers whose claim.name or user.attribute fields target realm_access, resource_access, groups, or other role-bearing claims.
Access tokens issued to newly registered clients that contain administrative roles inconsistent with the underlying user's directory entitlements.
Sudden appearance of new clients registered via Initial Access Tokens shortly followed by administrative API calls from those clients.

Detection Strategies

Audit Keycloak event logs for CLIENT_REGISTER events and inspect the mapper configuration payload for suspicious claim.name values.
Correlate token issuance with administrative REST activity (/admin/realms/*) originating from clients created within the same session.
Compare role claims in issued tokens against the authenticated user's assigned realm and client roles to identify divergences.

Monitoring Recommendations

Enable Keycloak's admin and login event listeners and forward events to a centralized SIEM for correlation.
Alert on any DCR request that defines a mapper of type oidc-usermodel-property-mapper or oidc-usermodel-attribute-mapper targeting privileged claim names.
Track issuance and use of Initial Access Tokens, and rotate or revoke any tokens not tied to a documented onboarding workflow.

How to Mitigate CVE-2026-16102

Immediate Actions Required

Apply the fixed Keycloak packages referenced in RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849.
Revoke all outstanding Initial Access Tokens and reissue them only for controlled onboarding workflows.
Review clients registered through DCR since the deployment date and remove any with User Property mappers targeting role claims.
Rotate client secrets for any client that may have been exposed through forged administrative access.

Patch Information

Red Hat has released fixed packages under advisories RHSA-2026:50846, RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849. Consult the Red Hat CVE-2026-16102 Information page for the mapping between advisory and affected Keycloak build. Apply the vendor-supplied update rather than manual configuration changes wherever possible.

Workarounds

Disable Dynamic Client Registration on realms that do not require it by removing the anonymous and authenticated DCR policies from the realm configuration.
Restrict the DCR client policy to prohibit registration of oidc-usermodel-property-mapper and oidc-usermodel-attribute-mapper protocol mappers until patches are applied.
Limit issuance of Initial Access Tokens to short lifetimes and a low count, and scope them to trusted administrators only.

bash

# Example: restrict Dynamic Client Registration policy to disallow user property mappers
# Run against the target realm; requires kcadm.sh authenticated as a realm admin

kcadm.sh update realms/<REALM>/client-policies/policies \
  -s 'policies=[{
        "name": "restrict-dcr-mappers",
        "description": "Block user property mappers via DCR",
        "enabled": true,
        "conditions": [
          { "condition": "client-updater-context",
            "configuration": { "update-client-source": ["ByInitialAccessToken","ByRegistrationAccessToken"] } }
        ],
        "profiles": ["restrict-mappers-profile"]
      }]'