A security flaw in the client registration service of Red Hat build of Keycloak 26.4 allows a remote attacker possessing a previously issued Registration Access Token to re-enable a client that was explicitly disabled by an administrator. This bypasses intended security controls, enabling the attacker to reset the client's secret and potentially regain privileged API access. The vulnerability impacts confidentiality and integrity by allowing unauthorized information disclosure and control over client credentials. Red Hat has published security advisories recommending updating to Keycloak 26.4.13, which includes fixes for this and multiple other vulnerabilities. However, the advisory does not explicitly confirm a patch specifically for CVE-2026-9705, so patch status should be verified with the vendor.

The vulnerability allows unauthorized re-enabling of disabled clients via a previously issued Registration Access Token, bypassing security controls. This can lead to unauthorized information disclosure and compromise of integrity by enabling attackers to reset client secrets and regain privileged API access. The CVSS 3.1 base score is 6.5, indicating a medium severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

Red Hat has released updated packages for Red Hat build of Keycloak 26.4.13 that address this vulnerability among others. Users should apply these updates as recommended by the vendor. Since the vendor advisory does not explicitly state the patch status for CVE-2026-9705 alone, it is important to verify the current remediation status on the Red Hat Customer Portal and apply the official fix when available. Back up existing installations before applying updates. No vendor advisory states that no action is required or that the issue is already mitigated without updates.