CVE-2026-105306 Red Hat CVE debrief

Who should care

Defenders managing Keycloak instances, especially those with untrusted registration or multiple applications in the same realm, should assess exposure and prioritize verification and mitigation.

Why it matters

CVE-2026-105306 allows an attacker to bypass audience checks during token introspection, potentially exposing sensitive information from access tokens of other applications in the same Keycloak realm. Defenders managing Keycloak instances should assess exposure, prioritize verification of token access restrictions, and monitor for suspicious activity.

• Potential exposure of sensitive identity information and roles
• Possible unauthorized access to session details from access tokens
• Need for verification of Keycloak instance exposure and token access restrictions
• Priority on monitoring for suspicious client registrations and token introspection requests

Technical summary

The vulnerability occurs because Keycloak's Dynamic Client Registration process fails to filter security-sensitive client attributes when a new client is created. An attacker can register a client that bypasses audience checks during token introspection, potentially exposing sensitive information from access tokens of other applications in the same realm. This issue highlights the importance of properly configuring client registrations and token access restrictions in Keycloak deployments. Affected product deployments should be identified, and defenders should prioritize verifying exposure and mitigating the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of Keycloak instances to untrusted registration, restricting token access, and monitoring for suspicious client registrations and token introspection requests.

Recommended defensive actions

• Verify Keycloak instance exposure to untrusted registration
• Restrict token access and permissions
• Monitor for suspicious client registrations and token introspection requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description and NVD entry provide details on the vulnerability in Keycloak's Dynamic Client Registration flow, but do not specify affected versions or provide remediation guidance. The lack of specific version information makes it challenging for defenders to assess exposure and prioritize mitigation efforts. Further investigation is needed to determine the scope of affected systems and to develop effective remediation strategies. Defenders should verify the exposure of their Keycloak instances to untrusted registration and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.