CVE-2026-9705: CVE-2026-9705: Registration Access Token Authorization Bypass in Keycloak Dynamic Client Registration

#security #cve #cybersecurity

CVE-2026-9705: Registration Access Token Authorization Bypass in Keycloak Dynamic Client Registration

Vulnerability ID: CVE-2026-9705
CVSS Score: 6.5
Published: 2026-10-29

CVE-2026-9705 is an insufficient session expiration and authorization bypass vulnerability in Keycloak and Red Hat build of Keycloak. The vulnerability occurs in the OAuth 2.0 Dynamic Client Registration Management Protocol implementation, where the authentication handler fails to verify whether a target client is enabled before accepting requests authenticated with a previously issued Registration Access Token (RAT). Consequently, an actor possessing a valid RAT for an administratively disabled client can query, update, and re-enable the client configuration, restoring revoked access to realm resources.

TL;DR

Keycloak fails to verify the enabled status of a client when authenticating Dynamic Client Registration management requests via a Registration Access Token (RAT). An attacker holding a previously issued RAT can bypass administrative deactivation, re-enable the disabled client, rotate secrets, and regain OAuth 2.0 client privileges.

Technical Details

CWE ID: CWE-613: Insufficient Session Expiration
CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Attack Vector: Network (HTTP/HTTPS REST API via /realms/{realm}/clients-registrations/*)
Affected Component: org.keycloak.services.clientregistration.ClientRegistrationAuth
EPSS Score: 0.46% (40.18th Percentile)
Security Impact: Unauthorized reactivation and modification of administratively disabled OAuth 2.0 clients
Exploit Status: No known public exploits or active exploitation observed
CISA KEV Status: Not Listed

Affected Systems

Keycloak
Red Hat build of Keycloak 26.4
Red Hat build of Keycloak 26.6
Keycloak: >= 26.4.0, < 26.4.13 (Fixed in: 26.4.13)
Keycloak: >= 26.6.0, < 26.6.4 (Fixed in: 26.6.4)
Red Hat build of Keycloak: >= 26.4.0, < 26.4.13 (Fixed in: 26.4.13-1)
Red Hat build of Keycloak: >= 26.6.0, < 26.6.4 (Fixed in: 26.6.4-2)

Code Analysis

Commit: be81d60

CVE-2026-9705 check if client is enabled when RAT is used

@@ -213,7 +213,7 @@ public void requireView(ClientModel client, boolean allowPublicClient) {
                 throw forbidden();
             }
         } else if (isRegistrationAccessToken()) {
-            if (client != null && client.getRegistrationToken() != null && client.getRegistrationToken().equals(jwt.getId())) {
+            if (client != null && client.isEnabled() && client.getRegistrationToken() != null && client.getRegistrationToken().equals(jwt.getId())) {
                 checkClientProtocol(client);
                 authenticated = true;
                 authType = getRegistrationAuth();
@@ -325,7 +325,7 @@ private RegistrationAuth requireUpdateAuth(ClientModel client) {
                 throw forbidden();
             }
         } else if (isRegistrationAccessToken()) {
-            if (client != null && client.getRegistrationToken() != null && client.getRegistrationToken().equals(jwt.getId())) {
+            if (client != null && client.isEnabled() && client.getRegistrationToken() != null && client.getRegistrationToken().equals(jwt.getId())) {
                 return getRegistrationAuth();
             }
         }

Mitigation Strategies

Upgrade Keycloak or Red Hat build of Keycloak to a patched release that verifies client enabled state during RAT validation.
Restrict network access to Dynamic Client Registration endpoints (/realms/{realm}/clients-registrations/*) using reverse proxies, ingress controllers, or WAF rules.
Manually rotate the Registration Access Token in the Keycloak Admin Console whenever disabling a client on an unpatched instance.

Remediation Steps:

Identify all deployed instances of Keycloak and Red Hat build of Keycloak across the environment.
Upgrade Keycloak 26.4.x deployments to version 26.4.13 or later, and Keycloak 26.6.x deployments to version 26.6.4 or later.
Audit existing disabled clients in all realms and regenerate their Registration Access Tokens via the Admin Console (Clients -> [Client] -> Credentials -> Regenerate registration access token) to ensure any leaked pre-patch tokens are invalidated.
If immediate patching is not possible, configure the edge reverse proxy or load balancer to deny HTTP requests matching the path pattern /realms//clients-registrations/ from untrusted networks.

References

Read the full report for CVE-2026-9705 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community