CVE-2026-16102 is a security flaw in the Dynamic Client Registration (DCR) component of Red Hat Build of Keycloak. The default DCR policy does not properly validate the claim path for User Property mappers, which allows an attacker possessing a standard user account and a limited Initial Access Token to forge administrative roles within their access token. Exploiting this vulnerability enables the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm. The root cause is the lack of claim path validation in the default DCR mapper policy. Red Hat has assessed this vulnerability as Important due to its potential for significant privilege escalation and full realm compromise. No official patch or mitigation meeting Red Hat's criteria is currently available.

Successful exploitation allows an attacker to escalate privileges from a standard user to an administrative level, enabling them to read confidential client secrets, modify security configurations, impersonate administrative service accounts, and potentially gain full administrative control over the Keycloak realm. This can lead to compromise of multiple clients and sensitive data within the affected environment.

As of the latest Red Hat advisory, no effective mitigation or official patch is available that meets Red Hat's criteria for ease of use, applicability, and stability. Users should monitor the Red Hat advisory for updates and consider engaging with Red Hat support or Technical Account Managers for guidance. Until a fix is released, restricting access to the Dynamic Client Registration feature or limiting the issuance of Initial Access Tokens may reduce exposure, but these are not official mitigations.