CVE-2026-9792

Vulnerability

A flaw exists in Keycloak's Client Policies, specifically within the org.keycloak.protocol.oidc component. When certain condition providers (client-type, client-roles, client-attributes, client-scopes) are used to enforce security restrictions, the reject-ropc-grant executor is silently bypassed. The exact affected versions are not disclosed in the available references [1][2].

Exploitation

An unauthenticated remote attacker can exploit this bypass by sending a Resource Owner Password Credentials (ROPC) grant request to a Keycloak endpoint that has a client policy configured with the reject-ropc-grant executor. The attacker does not need any prior authentication or special network position. The bypass occurs silently, allowing the attacker to obtain tokens even when the policy is explicitly configured to block ROPC grants [1][2].

Impact

Successful exploitation allows the attacker to obtain tokens via the ROPC grant flow, leading to unauthorized access to protected resources and potential information disclosure. The attacker gains the privileges associated with the token scope, which may include access to sensitive data or actions [1][2].

Mitigation

As of the publication date (2026-05-28), no fix has been released. Red Hat has not provided a workaround in the available references. Users should monitor for updates from Red Hat and apply patches as soon as they become available [1][2].