The flaw in the Dynamic Client Registration flow allows the injection of user profile information into the protected fields of identity tokens, such as sub (user ID) and aud (audience). Input validation is missing, which lets an attacker holding a legitimate token with appropriate iat claims create a malicious application that issues signed security tokens containing forged subject and audience values. This enables the attacker to impersonate other users and gain unauthorized access to services that rely on these tokens for authentication, thereby breaching confidentiality and integrity.

The affected products are the Red Hat Build of Keycloak and Red Hat Single Sign‑On 7. Version specifics are not supplied in the public advisory, so any deployment of these products that has not applied the vendor’s security update could be susceptible.

The CVSS score of 8.1 marks this flaw as high severity. No EPSS value is available, but the lack of known exploits and the requirement for a privileged token to register a client make exploitation non‑obvious. The vulnerability is not listed in the CISA KEV catalog, indicating no active exploitation campaigns are currently known, yet the high impact warrants immediate remediation. Application of the patch is the only known effective remedy; meanwhile, disabling or limiting DCR for untrusted users can reduce the attack surface.