A vulnerability in the keycloak-services component of Keycloak allows bypassing host-based restrictions when a realm administrator uses a wildcard domain to restrict client registration or updates. Improper validation permits acceptance of any hostname ending with the specified domain suffix, enabling an attacker controlling reverse DNS to potentially modify clients without authorization. The issue has a low CVSS score and no known exploits in the wild. A security update is available in Red Hat build of Keycloak 26.6.8 addressing this and other issues.