CVE-2026-16102: redhat build_of_keycloak
Vulnerability summary
CVE-2026-16102 is a high (CVSS 8.1) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities.
Timeline
- 05-08-2026PublishedVulnerability first disclosed.
- 31-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
+0.14 pp
From 0.32% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Affected systems
Redhat4 products
- build_of_keycloak≥ 26.4, < 26.4.14 | ≥ 26.6, < 26.6.5
- data_grid8.0
- jboss_enterprise_application_platform_expansion_packna
- single_sign-on7.0
1 vendor · 4 products