The vulnerability in Red Hat Build of Keycloak's keycloak-services component occurs when a realm administrator configures client policies enforcing authentication requirements on confidential clients. Due to improper evaluation of the client state during update operations, an attacker with client management permissions can bypass these policies by first creating a public client and then updating it to a confidential client with weaker authentication. This results in clients persisting that do not comply with the intended security hardening of the realm. The root cause is that update operations are evaluated against the previous client state rather than the proposed new state. Exploitation requires low privileges (client management permissions) and no user interaction. The vulnerability impacts integrity by allowing modification of client authentication settings contrary to policy. Red Hat has assessed the severity as moderate and currently does not provide a fix or effective mitigation.

An attacker with client management privileges or a dynamic registration token can bypass realm-specific client policy conditions, allowing confidential clients to persist with weaker authentication than intended. This compromises the integrity of client authentication enforcement within the realm. There is no impact on confidentiality or availability reported. The vulnerability does not allow privilege escalation beyond client management permissions but undermines security policies designed to harden authentication requirements.

Red Hat currently does not offer a fix or effective mitigation for this vulnerability. The available options do not meet Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat's advisory for updates. Since exploitation requires existing client management privileges, restricting such permissions and carefully managing client registration tokens may reduce risk. Engage with Red Hat support or Technical Account Managers for further guidance.