The Dynamic Client Registration (DCR) component of Keycloak fails to properly validate the claim path for User Property mappers under its default policy. This flaw permits an attacker possessing a standard user account and a limited Initial Access Token to forge administrative roles within their access token. Exploitation enables the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm. The root cause is a lack of claim path validation in the default DCR mapper policy. The vulnerability has been assigned CVE-2026-16102 with a CVSS 3.1 base score of 8.1 (high severity).

Successful exploitation allows significant privilege escalation, enabling attackers to impersonate administrative roles, read confidential client secrets, modify security configurations, and potentially gain full administrative control over the Keycloak realm. This compromises confidentiality and integrity but does not affect availability.

According to the Red Hat advisory, no mitigation or fix currently meets their criteria for ease of use, applicability, or stability. Therefore, no official patch or mitigation is available at this time. Users should monitor vendor advisories for updates and consider restricting access to Dynamic Client Registration functionality or limiting user privileges as interim risk reduction measures.