Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-9705 · GHSA-r7rc-c989-86g6

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Risk score
52/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.5%
Published
25 Jun 2026

Open in the live forecast Today's forecast

What to know

What it is
A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client…
Affected
org.keycloak:keycloak-services (maven) < 26.6.4
Fix
Upgrade org.keycloak:keycloak-services to 26.6.4 or later.
Exploitation
No known exploitation

Story map

Story map: org.keycloak:keycloak-servicesTHE FLAWSTHE FIXCVE-2026-9705Keycloak: Attacker canre-enable and take overdisabled clients via…CVSS 6.5 · EPSS 0%CVE-2026-9800Keycloak vulnerable toauthorization bypass viaincorrect uri comparisonCVSS 8.1 · EPSS 1%CVE-2026-9086Keycloak vulnerable tocross-site scripting (xss) viacase-insensitive uri validation…CVSS 7.3 · EPSS 1%CVE-2026-9083Keycloak vulnerable toinformation disclosure througharbitrary filesystem path…CVSS 4.9 · EPSS 1%FixUpgrade to version 26.6.4 forkeycloak-services or 26.0.10for keycloak-policy-enforcerWho is exposed{'products': ['Keycloak'],'packages': [{'ecosystem':'maven', 'name':'org.keycloak:keycloak-services', 'vulnerable': '< 26.6.4'}…AMBER · PATCH THIS WEEKorg.keycloak:keycloak-servicesKeycloak Policy Enforcer has aflaw that allows anyauthenticated user to bypassauthorization policies byincluding the access-denied pagepath in a request URL. Thisallows unauthorized access to…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-613 (CWE-613)40 other warnings in 30 days →Same productEarlier org.keycloak:keycloak-services warnings1 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

org.keycloak:keycloak-services: Amber, patch this week. Keycloak Policy Enforcer has a flaw that allows any authenticated user to bypass authorization policies by including the access-denied page path in a request URL. This allows unauthorized access to protected resources.

The flaws

  • CVE-2026-9705: Keycloak: Attacker can re-enable and take over disabled clients via registration access token (CVSS 6.5 · EPSS 0%)
  • CVE-2026-9800: Keycloak vulnerable to authorization bypass via incorrect uri comparison (CVSS 8.1 · EPSS 1%)
  • CVE-2026-9086: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass (CVSS 7.3 · EPSS 1%)
  • CVE-2026-9083: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing (CVSS 4.9 · EPSS 1%)

The fix

Fix: Upgrade to version 26.6.4 for keycloak-services or 26.0.10 for keycloak-policy-enforcer

Who is exposed: {'products': ['Keycloak'], 'packages': [{'ecosystem': 'maven', 'name': 'org.keycloak:keycloak-services', 'vulnerable': '< 26.6.4'}, {'ecosystem': 'maven', 'name': 'org.keycloak:keycloak-policy-enforcer', 'vulnerable': '< 26.0.10'}]}

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: Maven

Affected packages

PackageEcosystemVulnerableFixed in
org.keycloak:keycloak-servicesmaven< 26.6.426.6.4

References

Original description

A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client's secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.

Last activity 29 Oct 2026. Patch Forecast updates every hour.