CVE-2026-105306: Missing Authorization in Red Hat Red Hat Build of Keycloak

This vulnerability exists because the registration process in the Dynamic Client Registration flow of Red Hat Build of Keycloak does not properly filter security-sensitive client attributes when creating a new client. An attacker possessing a valid Initial Access Token can exploit this to register a client that circumvents audience checks during token introspection, thereby gaining access to sensitive identity data and session details from access tokens belonging to other applications in the same realm.

An attacker with limited privileges (valid Initial Access Token) can bypass audience checks during token introspection, leading to unauthorized disclosure of sensitive identity information, roles, and session details from access tokens of other applications in the same realm. This impacts confidentiality but does not affect integrity or availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105306 for current remediation guidance. Until an official fix is available, restrict issuance and use of Initial Access Tokens to trusted parties only to reduce risk.