Threats tagged 'ghsa-r7rc-c989-86g6'

A vulnerability in Keycloak's client registration service allows an attacker with a previously issued Registration Access Token (RAT) to re-enable clients that an administrator has disabled. This enables the attacker to reset the client's secret and potentially regain privileged API access, leading to unauthorized information disclosure and integrity compromise. The issue affects versions prior to 26.6.4 and has been assigned CVE-2026-9705 with a CVSS score of 6.5 (medium severity). A patch is available in version 26.6.4.