Threats tagged 'ghsa-5g6f-qmff-3rjc'

A vulnerability in Keycloak's Dynamic Client Registration (DCR) endpoint allows an authenticated attacker with client creation privileges or an Initial Access Token (IAT) to inject excessive roles into the realm's default roles configuration. This results in clients generating bloated access tokens, causing performance and memory degradation that can lead to denial of service (DoS). The flaw does not grant unauthorized access to protected resources but impacts availability due to resource exhaustion.