CVE-2026-16102

Katalog CVE

CVSS 8.1 · High EPSS 0,46%

Kerentanan Incorrect Behavior Order: Authorization Before Parsing and Canonicalization pada redhat build of keycloak, redhat data grid +2 lainnya. Skor CVSS 3.1 8.1 (High) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

Rincian

Terbit di NVD

5 Agustus 2026

Terakhir diubah

31 Agustus 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber redhat.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-284: Improper Access Control

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:50846 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50847 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50848 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:50849 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-16102 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2501735 issue tracking