Keycloak Dynamic Client Registration Privilege Escalation

Executive Summary

CVE-2026-15572 is a flaw in Keycloak's Dynamic Client Registration (DCR) security policy. The 'Allowed Protocol Mapper Types' policy fails to re-validate the mapper type during a client update if the mapper's configuration remains unchanged. An attacker with client registration privileges can exploit this by registering an allowed mapper type with a malicious configuration, then swapping it for a restricted, high-privilege mapper type to gain full administrative access to the Keycloak realm.

Useful 0 Not Useful 0

Detection Guidance

Monitor Keycloak logs for unauthorized client updates or suspicious mapper type changes. Check for clients with unexpected administrative roles or high-privilege mappers. Review DCR API calls for PUT requests that modify mapper types without changing configuration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to escalate privileges and gain full administrative access to the Keycloak realm. This could lead to unauthorized modification of security settings, access to sensitive user data, or causing a denial of service. The impact includes potential data breaches, loss of system integrity, and disruption of services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data exposure, and failure to protect personal or health information, leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Disable Dynamic Client Registration if not required. Restrict client registration privileges to trusted users only. Apply Keycloak patches or updates as soon as they become available. Monitor for unauthorized administrative role assignments.

Useful 0 Not Useful 0