Bug 2535817 (CVE-2026-92857)

Summary: CVE-2026-92857 keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-12-15   

Description OSIDB Bzimport 2026-09-17 05:19:26 UTC 
A flaw was found in Keycloak where the Dynamic Client Registration (DCR) policy Allowed Protocol Mapper Types fails to validate the configuration of protocol mappers, specifically the claim.name field. While the policy restricts the mapper types that can be used, it does not prevent an attacker from configuring allowed mappers (such as User Property or User Attribute mappers) to write to reserved identity claims.
An attacker with a valid Initial Access Token (IAT) and a standard realm account can register a new client and configure mappers to map their own editable profile attributes to the sub and aud claims. When the attacker authenticates via this registered client, Keycloak issues access tokens, ID tokens, and UserInfo responses signed by the realm's active key where the sub claim contains an arbitrary user's UUID and the aud claim contains an arbitrary audience value. This allows the attacker to forge identity tokens that pass standard relying-party validation, leading to potential impersonation and unauthorized access to resource servers. This is a residual gap in the fix for CVE-2026-16102.