CVE-2026-9705

Description

A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.

Traduire en français

Produits concernés

• Red Hat build of Keycloak 26.4
• Red Hat build of Keycloak 26.4.13
• Red Hat build of Keycloak 26.6
• Red Hat build of Keycloak 26.6.4
• Redhat build of keycloak

Scores CVSS

Faiblesses (CWE)

• CWE-613

Références

• https://access.redhat.com/errata/RHSA-2026:30049 Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30050 Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30083 Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:30084 Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-9705 Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2481878 Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories