A vulnerability in the Dynamic Client Registration component of Keycloak allows an attacker with valid registration credentials to create a client that maps standard user profile claims to sensitive security roles. This can lead to unauthorized privilege escalation on external applications that trust Keycloak tokens. The flaw stems from insufficient restriction on claim names during client setup. Exploitation requires valid initial access tokens and impacts external relying parties that use token claims for authorization. No official fix or mitigation meeting Red Hat's criteria is currently available.