A flaw was found in Keycloak Dynamic Client Registration (DCR) within the org.keycloak.services.clientregistration.policy package. The client registration policy validates allowed mapper types but fails to restrict the claim.name value during the registration process. An attacker possessing a valid Initial Access Token (IAT) can register a new client configured with an oidc-usermodel-attribute-mapper that maps a user-editable profile field, such as firstName, directly to the realm_access.roles claim. When a user subsequently authenticates through this client, the mapper injects the attacker-controlled field value into the realm_access.roles claim of the issued token. This allows an attacker to forge or corrupt the realm roles claim in tokens provided to external relying parties. While Keycloak internal authorization and the Admin REST API are unaffected because they evaluate the user role model directly, external applications relying on the realm_access.roles claim for access control are vulnerable to privilege escalation.