CVE-2026-16102 is a security flaw in the Dynamic Client Registration (DCR) component of Red Hat build of Keycloak 26.4. The default DCR policy does not properly validate the claim path for User Property mappers, which allows an attacker with a standard user account and a limited Initial Access Token to forge administrative roles in their access token. This vulnerability enables the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm. The root cause is a lack of claim path validation in the default DCR mapper policy. The Red Hat Product Security team rates this vulnerability as Important due to the significant privilege escalation and full realm compromise it allows. The CVSS v3.1 base score is 8.1 (High severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impact.

Successful exploitation allows an attacker with low privileges to escalate their privileges by forging administrative roles in their access token. This leads to the ability to take over other clients, steal confidential client secrets, modify security configurations, impersonate administrative service accounts, and potentially gain full administrative control over the Keycloak realm. The confidentiality and integrity impacts are high, while availability is not affected.

As of the latest Red Hat advisory, no official fix or patch is currently available for this vulnerability. Mitigation options either do not meet Red Hat's criteria for ease of use, deployment, applicability, or stability. Users are advised to monitor Red Hat's security advisories for updates. The Red Hat build of Keycloak 26.4.14 security update includes multiple fixes but does not explicitly list a fix for CVE-2026-16102, indicating the fix may not yet be released or is pending. Customers with a Technical Account Manager (TAM) can review this CVE directly with their TAM for tailored guidance. It is recommended to back up existing installations before applying any future updates.