CVE-2026-9803: Keycloak ClientRegistrationAuth DoS Flaw

CVE-2026-9803 Overview

A flaw exists in the ClientRegistrationAuth component of Keycloak, the open-source identity and access management solution maintained by Red Hat. A remote unauthenticated attacker can trigger an out-of-bounds read [CWE-125] by sending a specially crafted POST request containing a malformed Authorization: Bearer header to any client registration endpoint. The malformed header causes an ArrayIndexOutOfBoundsException inside the authentication parsing logic. The server responds with HTTP 500 and the affected request path becomes unavailable, producing a Denial of Service (DoS) condition on the client registration service.

Critical Impact

Unauthenticated remote attackers can degrade availability of Keycloak's client registration endpoints by sending malformed bearer tokens.

Affected Products

• Red Hat Keycloak (see Red Hat CVE-2026-9803 Advisory for affected versions)
• Red Hat build of Keycloak
• Red Hat Single Sign-On distributions referencing the ClientRegistrationAuth component

Discovery Timeline

• 2026-05-28 - CVE CVE-2026-9803 published to NVD
• 2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-9803

Vulnerability Analysis

The defect resides in Keycloak's ClientRegistrationAuth component, which handles authentication for dynamic client registration endpoints. When a request arrives, the component parses the Authorization header to extract a bearer token. The parsing routine assumes a well-formed Bearer <token> structure and indexes into the resulting token array without validating its length. A malformed header, such as one containing only the scheme keyword or an empty value, produces a shorter array than the code expects. The resulting ArrayIndexOutOfBoundsException is not caught at the request-handler layer and propagates upward, returning HTTP 500 to the caller. Because the endpoint accepts unauthenticated requests as part of its normal flow, no credentials are required to trigger the fault. Repeated requests can keep client registration unavailable, disrupting onboarding of new OAuth and OIDC clients in environments that rely on dynamic registration.

Root Cause

The root cause is missing input validation on the Authorization header before array indexing [CWE-125]. The parser splits the header value and accesses positional elements without first confirming the array contains the expected number of tokens. This is a classic out-of-bounds read pattern in header parsing logic, surfacing here as an unhandled runtime exception rather than a memory disclosure because the JVM enforces array bounds.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a POST request to any client registration endpoint, such as /realms/<realm>/clients-registrations/default, with an Authorization header value that does not conform to the expected Bearer <token> pattern. Examples include sending only Authorization: Bearer with no token, or a header containing whitespace-only content. The server raises an ArrayIndexOutOfBoundsException and returns HTTP 500. See the Red Hat Bugzilla Report #2482465 for the upstream tracking entry.

Detection Methods for CVE-2026-9803

Indicators of Compromise

• HTTP 500 responses originating from /realms/*/clients-registrations/* endpoints in Keycloak access logs.
• Stack traces in Keycloak server logs containing ArrayIndexOutOfBoundsException referencing the ClientRegistrationAuth class.
• Unauthenticated POST requests carrying truncated or empty Authorization: Bearer headers.

Detection Strategies

• Alert on bursts of HTTP 500 responses from client registration endpoints over short time windows.
• Parse Keycloak server.log for repeated ArrayIndexOutOfBoundsException traces tied to authentication parsing.
• Correlate source IPs producing malformed Authorization headers across multiple realms to identify probing behavior.

Monitoring Recommendations

• Forward Keycloak application and access logs to a centralized log platform with retention sufficient for incident review.
• Track availability metrics for the clients-registrations endpoints separately from the broader Keycloak service.
• Set rate-limit thresholds at the reverse proxy or API gateway in front of Keycloak and alert on sustained 5xx error ratios.

How to Mitigate CVE-2026-9803

Immediate Actions Required

• Apply the Keycloak security update referenced in the Red Hat CVE-2026-9803 Advisory as soon as it is available for your distribution.
• Restrict network access to client registration endpoints to trusted networks or authenticated administrative tooling where dynamic registration is not required publicly.
• Review Keycloak logs for prior ArrayIndexOutOfBoundsException events to determine if the flaw was triggered before patching.

Patch Information

Red Hat tracks remediation under the Red Hat CVE-2026-9803 Advisory and Red Hat Bugzilla Report #2482465. Administrators should consult these references for the fixed version mapping that applies to their specific Keycloak or Red Hat build of Keycloak deployment.

Workarounds

• Disable the dynamic client registration feature on realms that do not require it, removing the vulnerable endpoint surface.
• Place a reverse proxy or web application firewall in front of Keycloak to reject requests whose Authorization header does not match a strict Bearer [A-Za-z0-9._-]+ pattern.
• Rate-limit unauthenticated requests to /realms/*/clients-registrations/* to reduce the impact of repeated exploitation attempts.