CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
Attackers with standard accounts can forge administrative roles via flawed Dynamic Client Registration policies, gaining full realm control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-16102?
CVE-2026-16102 is a high-severity vulnerability in Redhat Build of Keycloak, published on 5 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.
Which versions are affected by CVE-2026-16102?
1 open source package ship an affected version, including keycloak. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
keycloak Bitnami | From 26.4.0 | 26.4.14, 26.6.5 |
Products include Redhat Build of Keycloak, Redhat Data Grid, Redhat Jboss Enterprise Application Platform Expansion Pack, Redhat Single Sign-On.
How do I fix CVE-2026-16102?
Upgrade keycloak to a fixed version for your release line: 26.4.14 or 26.6.5.
Is CVE-2026-16102 being exploited?
There is no known exploitation of CVE-2026-16102 in the wild and no public exploit code.
Other vulnerabilities in Redhat Build of Keycloak
- CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- CVE-2026-3047 Keycloak SAML Broken has Authentication Bypass by Primary Weakness
- CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
- CVE-2026-11800 Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion
Sources
Also known as BIT-keycloak-2026-16102, GHSA-6x4h-v8cp-whwh.