This vulnerability exists in the full-scope-disabled client-policy executor within the keycloak-services component of Red Hat Build of Keycloak. The executor validates the fullScopeAllowed field only if explicitly provided in a request. If this field is omitted, a delegated user can bypass the policy, creating a client with full scope access and obtaining tokens with unauthorized role mappings. The root cause is the executor's failure to consider default server behavior when fullScopeAllowed is missing. Exploitation requires delegated client creation privileges and a specific policy configuration in the realm. Red Hat has assessed the severity as moderate and currently has no suitable mitigation or fix available.

Successful exploitation allows an attacker with delegated client creation privileges to bypass client scope restrictions, resulting in clients that have full scope access. This enables the attacker to obtain tokens with unauthorized role mappings, potentially leading to unauthorized access to sensitive data and modification of application data. The vulnerability impacts confidentiality and integrity but does not affect availability. Exploitation complexity is low, and no user interaction is required.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, and stability. Users should monitor the Red Hat advisory for updates. Since exploitation requires delegated client creation privileges and specific policy configurations, restricting such privileges and reviewing client policies may reduce risk. No direct mitigation is currently available from Red Hat.