The vulnerability in Red Hat build of Keycloak 26.4's Dynamic Client Registration (DCR) component arises from improper validation of claim paths in the default DCR policy for User Property mappers. This allows an attacker possessing a standard user account and a limited Initial Access Token to escalate privileges by forging administrative roles within their access token. Exploitation can lead to unauthorized takeover of clients, theft of confidential secrets, and full administrative control over the realm. The root cause is a lack of claim path validation before authorization checks. Red Hat has assessed the severity as Important and assigned a CVSS v3.1 score of 8.1. No effective mitigation or patch currently meets Red Hat's criteria for ease of use and applicability, though a security update for Keycloak 26.4.14 addressing multiple issues including this vulnerability is available.

Successful exploitation allows attackers with low privileges to escalate to administrative roles, enabling them to take over other clients, access confidential secrets, and gain full administrative control over the Keycloak realm. This compromises confidentiality and integrity of the system without affecting availability.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for ease of use, applicability, or stability. However, a security update to Red Hat build of Keycloak 26.4.14 has been released which includes fixes for this vulnerability. Users should upgrade to version 26.4.14 or later to remediate this issue. Before updating, back up existing installations including configurations and databases. Customers with Red Hat Technical Account Managers can seek direct assistance. Monitor Red Hat advisories for further updates.