Keycloak Client Registration Service Privilege Escalation via Re-enabled Client CVE-2026-9705

Vulnerability Overview Vulnerability ID: CVE-2026-9705 Vulnerability Title: Keycloak: Attacker can re-enable and take over disabled clients via registration access tokens Status: NEW Report Date: 2026-05-27 12:50 UTC Modified Date: 2026-06-25 15:59 UTC CC List: 11 users (show) Product: Security Response Component: vulnerability Version: unspecified Hardware: All Operating System: Linux Priority: medium Severity: medium Target Milestone: unspecified Assigned To: Product Security Impact Scope Description: A vulnerability was discovered in Keycloak's client registration service. A remote attacker, who possesses a previously issued Registration Access Token (RAT), can exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impacts include unauthorized information disclosure and potential integrity compromise. Remediation Plan Fixed Version: unspecified Closed Date: unspecified Environment: unspecified Last Closed: unspecified Embargoed: unspecified Attachments Attachment Name: OSIDB Bzimport Attachment Date: 2026-05-27 12:50:54 UTC Attachment Description: Comments Comment: You need to log in to leave a comment or make changes to this vulnerability. Other Information Links: - Terms of Use - Privacy - Contact - FAQ - Legal Summary This vulnerability involves a security issue in Keycloak's client registration service, allowing attackers to re-enable disabled clients via registration access tokens, leading to unauthorized information disclosure and potential integrity compromise. Specific fixed versions and closed dates have not yet been provided.

Goal Reached Thanks to every supporter — we hit 100%!

Keycloak Client Registration Service Privilege Escalation via Re-enabled Client CVE-2026-9705