A flaw in Keycloak’s Docker v2 authentication endpoint permits tokens to be issued even after an administrator disables a Docker registry client, meaning previously valid credentials can continue to procure authentication tokens. The vulnerability weakens administrative controls by allowing unauthorized access to container registry resources. It is an authorization weakness, classified as CWE‑285. There is no indication of code execution or denial‑of‑service potential; the impact is limited to unauthorized access.

Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign‑On 7, Red Hat Build of Keycloak 26.4, and Red Hat Build of Keycloak 26.4.10.

The CVSS score of 3.8 indicates a low severity impact, and the EPSS probability of less than 1 % shows a very low likelihood of exploitation at present. It is not listed in the KEV catalog, suggesting it has not been widely exploited. The likely attack scenario involves a compromised or legitimate user continuing to obtain tokens via the Docker registry protocol even after the client is disabled, so the vulnerability is exploitable with minimal effort and without additional privileges.