Keycloak: Three Medium-Severity Flaws in Client Registration and Authentication Disclosed Together
Three medium-severity vulnerabilities affecting Keycloak's client registration, session management, and certificate authentication were disclosed on October 5, 2026.
Key findings
- Three medium-severity vulnerabilities in Keycloak disclosed on October 5, 2026.
- CVE-2026-105306: Dynamic Client Registration fails to filter sensitive client attributes.
- CVE-2026-105302: User Session Note mapper may expose federated access tokens.
- CVE-2026-105301: X.509 authenticator vulnerable to crafted certificates pointing to malicious revocation sources.
On October 5, 2026, three medium-severity vulnerabilities were disclosed in the Keycloak identity and access management server. These vulnerabilities, all published on the same day, highlight potential weaknesses in client registration, session management, and certificate authentication. The disclosures collectively underscore the importance of rigorous validation and filtering of sensitive data within Keycloak's various authentication and registration flows.
One vulnerability, CVE-2026-105306, affects the Dynamic Client Registration flow. The issue arises because the registration process does not adequately filter security-sensitive client attributes during client creation. This could allow an attacker, possessing a valid Initial Access Token, to register a client with unintended or dangerous configurations.
Another vulnerability, CVE-2026-105302, impacts the User Session Note mapper. In this case, the mapper fails to validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This oversight could potentially lead to the exposure of these credentials to unauthorized parties.
The third vulnerability, CVE-2026-105301, is found within the X.509 client-certificate authenticator. When Keycloak is configured to check certificate revocation using CRL Distribution Points or OCSP, an attacker can supply a maliciously crafted certificate. This certificate could be designed to point to a malicious revocation source, potentially undermining the integrity of the certificate validation process.
The impact of these vulnerabilities ranges from the potential for unauthorized client registration with sensitive attributes to the exposure of federated access tokens and the circumvention of certificate revocation checks. Users of Keycloak are advised to review the specific details of each CVE and apply any available patches or mitigations provided by the vendor.
These disclosures emphasize the need for continuous security vigilance and prompt patching for identity and access management solutions like Keycloak. Organizations relying on Keycloak should ensure their systems are up-to-date to protect against these and other potential security threats.