The flaw lies in the full-scope-disabled client‑policy executor within the keycloak‑services component, which only validates the fullScopeAllowed attribute when it is explicitly sent in a request. By omitting this field, a delegated user can bypass the policy and create a client with full scope access. The resulting client can request tokens that include role mappings it should not have, effectively escalating privileges and enabling unauthorized access to protected resources. The weakness is classified as CWE‑862, an authorization failure.

The vulnerability affects Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. Specific product versions are not listed in the CNA data, so the impact likely applies to all currently supported releases containing the keycloak‑services component.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score of less than 1 % suggests the probability of exploitation is low and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires the ability to send a client registration request to the keycloak‑services API, omitting the fullScopeAllowed field. Attackers would need delegated user permissions to submit the request. Once exploited, the attacker can obtain tokens with elevated role mappings, leading to privilege escalation within the system.