Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92857— Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens

Quick assessment

Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Keycloak 提供动态客户端注册功能，允许持有特定令牌的用户自行注册其应用程序。然而，Keycloak 在验证此类注册请求时存在缺陷，使得攻击者能够创建恶意应用程序，从而伪造身份信息。通过将自身用户资料映射到受保护字段（如用户标识符 sub 或预期受众 aud），攻击者可生成签名的安全令牌，使其在系统中伪装成其他用户。这可能导致攻击者冒充他人，或未经授权访问依赖此类令牌进行身份验证的服务。

CVSS 8.1 · High

Affected Version Matrix 4

VendorProduct Version RangeStatus
Red Hat Red Hat Build of Keycloak any affected
any affected
any affected
Red Hat Red Hat Single Sign-On 7 any unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92857

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
Source: CVE Program / CVE List V5
Vulnerability Description
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat Single Sign-On 7 - cpe:/a:redhat:red_hat_single_sign_on:7

II. Public POCs for CVE-2026-92857

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92857

请登录查看更多情报信息。

Other References for CVE-2026-92857 (2)

Same Patch Batch · Red Hat · 2026-11-05 · 24 CVEs total

CVE-2026-117691 9.1 CRITICAL Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-e
CVE-2026-97175 8.8 HIGH Keycloak-services: keycloak-services: unverified idp email auto-linking enables account ta
CVE-2026-121994 8.8 HIGH Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length
CVE-2026-121996 8.2 HIGH Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted age
CVE-2026-121997 8.1 HIGH Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mis
CVE-2026-114232 8.1 HIGH Keycloak-services: keycloak-services: uma protection api resourcetype field not validated
CVE-2026-112208 8.1 HIGH Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organiza
CVE-2026-96453 8.0 HIGH Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbit
CVE-2026-107912 7.7 HIGH Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management inte
CVE-2026-121995 7.5 HIGH Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail
CVE-2026-107123 7.5 HIGH Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml d
CVE-2026-103112 7.5 HIGH Keycloak-services: keycloak-services: account takeover via authentication race using reset
CVE-2026-107602 7.5 HIGH Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo
CVE-2026-110931 7.5 HIGH Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authori
CVE-2026-110932 7.5 HIGH Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme
CVE-2026-82965 7.5 HIGH Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endp
CVE-2026-92855 7.4 HIGH Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without
CVE-2026-93998 7.4 HIGH Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configur
CVE-2026-97847 7.1 HIGH Keycloak-services: keycloak-services: client manager can substitute sessionless token prin
CVE-2026-97174 6.8 MEDIUM Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authent

Showing top 20 of 24 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Red Hat Build of Keycloak
Same vendor: Red Hat
Same weakness: CWE-20