A flaw in Keycloak’s Dynamic Client Registration (DCR) security policy management allows a client with registration privileges to bypass the “Allowed Protocol Mapper Types” rule. The policy fails to re‑validate a mapper’s type when its configuration is unchanged during an update, letting an attacker change an allowed mapper to a restricted, high‑privilege mapper such as one that hard‑codes administrative roles. Once the swap is complete the attacker gains full administrative access to the Keycloak realm, compromising confidentiality, integrity, and availability of all realm data. This weakness is a classic type confusion error, identified as CWE‑843.

Red Hat Build of Keycloak is affected. No specific version range is provided in the advisory, so administrators should verify installation against the latest release and review the changelog for the fix. All deployments that use DCR and expose client registration to untrusted actors are at risk.

The CVSS score is 8.8, indicating high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, but the attack path requires only client‑registration privileges, which may be granted to many users. The attacker can exploit the flaw by first registering an allowed mapper type with a malicious configuration, then updating the mapper to a restricted high‑privilege type; no additional authentication is required beyond the existing registration rights. Because the flaw resides in server‑side policy enforcement, it can be executed remotely over the standard DCR endpoint.