A flaw was found in Keycloak where the Dynamic Client Registration (DCR) policy Allowed Protocol Mapper Types fails to validate the configuration of protocol mappers, specifically the claim.name field. While the policy restricts the mapper types that can be used, it does not prevent an attacker from configuring allowed mappers (such as User Property or User Attribute mappers) to write to reserved identity claims.
An attacker with a valid Initial Access Token (IAT) and a standard realm account can register a new client and configure mappers to map their own editable profile attributes to the sub and aud claims. When the attacker authenticates via this registered client, Keycloak issues access tokens, ID tokens, and UserInfo responses signed by the realm's active key where the sub claim contains an arbitrary user's UUID and the aud claim contains an arbitrary audience value. This allows the attacker to forge identity tokens that pass standard relying-party validation, leading to potential impersonation and unauthorized access to resource servers. This is a residual gap in the fix for CVE-2026-16102.