Medium severity5.3NVD Advisory· Published May 28, 2026· Updated Jun 26, 2026
CVE-2026-9803
CVE-2026-9803
Description
A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | <= 26.4.7 | — |
org.keycloak:keycloak-servicesMaven | >= 26.5.0, < 26.6.3 | 26.6.3 |
Affected products
3(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
Patches
Vulnerability mechanics
References
15- access.redhat.com/security/cve/CVE-2026-9803nvdVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-cpf7-j4cf-vqx4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-9803ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:25097nvdWEB
- access.redhat.com/errata/RHSA-2026:25098nvdWEB
- access.redhat.com/errata/RHSA-2026:30049nvdWEB
- access.redhat.com/errata/RHSA-2026:30050nvdWEB
- github.com/keycloak/keycloak/commit/2b8692499e907e6205be0bd9c8a4da5d46f6ca30ghsaWEB
- github.com/keycloak/keycloak/commit/3fc06909cc93eb5c4739a712fa350de625812e04ghsaWEB
- github.com/keycloak/keycloak/commit/ef06df91d344c7e99fcb82987ef6adb854f30789ghsaWEB
- github.com/keycloak/keycloak/issues/49433ghsaWEB
- github.com/keycloak/keycloak/pull/49500ghsaWEB
- github.com/keycloak/keycloak/pull/49617ghsaWEB
- github.com/keycloak/keycloak/pull/49618ghsaWEB
News mentions
1- Keycloak: Twelve Vulnerabilities Disclosed, One High SeverityVypr Intelligence · May 28, 2026