The vulnerability CVE-2026-9803 exists in the ClientRegistrationAuth component of Red Hat Build of Keycloak. It allows a remote unauthenticated attacker to cause an out-of-bounds read by sending a malformed 'Authorization: Bearer' header in a POST request to any client registration endpoint. This triggers an ArrayIndexOutOfBoundsException, leading to an HTTP 500 error and denial of service. The CVSS 3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Successful exploitation results in a denial of service by causing the Keycloak server to return HTTP 500 errors due to an unhandled exception. There is no confidentiality or integrity impact reported. The service disruption could affect availability of authentication services relying on Keycloak's client registration endpoints.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-9803 for current remediation guidance. Until a fix is available, consider implementing network-level protections such as filtering or rate limiting malformed requests targeting client registration endpoints to reduce the risk of denial of service.