The vulnerability exists in Keycloak's DCR security policy where the "Allowed Protocol Mapper Types" policy does not re-validate the mapper type if the configuration remains unchanged during client updates. An attacker can exploit this by initially registering an allowed mapper type with a malicious configuration and then swapping it for a restricted mapper type that grants administrative privileges. This type confusion leads to privilege escalation, allowing the attacker to gain full administrative control over the Keycloak realm. The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, required privileges, and high impact on confidentiality, integrity, and availability.

Successful exploitation grants an attacker with client registration privileges the ability to escalate their privileges to full administrative access within the Keycloak realm. This compromises the confidentiality, integrity, and availability of the authentication and authorization services managed by Keycloak, potentially affecting all applications relying on it for identity management.

Red Hat has released updated packages for Red Hat build of Keycloak 26.4.14 that address this vulnerability. Users should apply these security updates promptly. Before updating, back up existing installations including applications, configuration files, and databases. No alternative mitigations or workarounds are specified in the vendor advisory. Patch status is confirmed by Red Hat advisories RHSA-2026:50846 and RHSA-2026:50847.