Keycloak’s Dynamic Client Registration endpoint fails to enforce proper authorization when handling the deprecated defaultRoles field. An authenticated user that has client creation rights or holds an Initial Access Token can supply an oversized list of roles. These roles are then incorporated into the realm’s default role configuration, causing every client in the realm to receive bloated tokens that contain a large number of roles. The resulting increase in token size and the memory required to manage them can exhaust server resources, degrade performance, and ultimately lead to a denial of service.

The vulnerability affects installations of the Keycloak identity and access management server. No specific version information is provided, so any deployment that has not applied the official fix or that still permits the deprecated defaultRoles field is potentially impacted.

The CVSS score of 6.8 indicates a medium severity and the lack of an EPSS score means we do not have data on exploitation prevalence. Keycloak does not list this flaw in the CISA KEV catalog. The attack requires legitimate credentials with client creation privileges or the acquisition of an Initial Access Token, implying that the threat is primarily directed at internal or partially compromised environments. After injection, the effect is a local denial of service that can become system wide due to resource exhaustion.