This vulnerability involves insufficient session expiration in the client registration service of Red Hat Build of Keycloak. An attacker possessing a previously issued Registration Access Token (RAT) can bypass administrative controls by re-enabling a disabled client. This enables the attacker to reset the client's secret, potentially regaining privileged API access. The flaw impacts confidentiality and integrity but does not affect availability. The CVSS 3.1 vector indicates the attack is network-based, requires no privileges or user interaction, and affects an unchanged security scope.

Successful exploitation can lead to unauthorized disclosure of information and compromise of data integrity by allowing an attacker to reset client secrets and regain privileged API access. There is no indication of availability impact. The vulnerability bypasses administrative controls intended to disable clients, undermining security policies.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-9705 for current remediation guidance. Until a fix is available, administrators should consider revoking or rotating Registration Access Tokens and monitor client status changes closely. No official fix or temporary workaround is currently documented by Red Hat.