This vulnerability in Red Hat Build of Keycloak enables a user who already has the 'manage-clients' permission to escalate privileges by injecting a hardcoded role mapper into any client. This injection bypasses existing scope restrictions and allows the attacker to add the 'realm-admin' role to generated tokens. As a result, the attacker gains full administrative access to the realm, effectively escalating their privileges beyond intended limits. The CVSS score is 6.5, indicating a medium severity level. No patch or official remediation level is currently stated in the vendor advisory, and no known exploits are reported in the wild.

An attacker with 'manage-clients' permission can escalate their privileges to full realm administrator by injecting the 'realm-admin' role into tokens. This results in complete administrative control over the realm, potentially compromising all realm resources and configurations.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-4629 for current remediation guidance. Until a fix is available, restrict 'manage-clients' permission to trusted users only to reduce risk.