A flaw in the Dynamic Client Registration component of Keycloak allows an attacker with valid registration credentials to set claim names that incorrectly map user profile data to sensitive security roles. The vulnerability can be exploited to create a malicious client that grants unauthorized privileges to external applications that trust Keycloak tokens. The issue stems from insufficient restrictions on claim names during client registration and is classified as a privilege escalation weakness.

Keycloak, the open-source identity and access management solution, is affected. No specific version range is supplied in the available data, so all deployments that use the current Dynamic Client Registration feature are potentially vulnerable until a patch is applied.

The CVSS score of 6.5 indicates a moderate severity flaw, but the EPSS score is not available, meaning the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog, suggesting there is no public evidence of widespread exploitation yet. A likely attack vector is by an attacker who has valid registration credentials, either by compromise or exploitation of a legitimate user, to submit a crafted client registration request that includes malicious claim mappings. Successful exploitation would allow the attacker to gain elevated privileges on any application that accepts Keycloak tokens with the forged realm_access.roles claim.