https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:45:14 +0000 https://cve.radiocsirt.org/vuln/cve-2026-15572 <p><strong>Affected:</strong> Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.14, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.5</p> <p>A flaw was found in Keycloak&#39;s Dynamic Client Registration (DCR) security policy management. The &#34;Allowed Protocol Mapper Types&#34; policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper&#39;s configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.</p> <p><strong>Affected:</strong> Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.14, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.5</p> <p>A flaw was found in Keycloak&#39;s Dynamic Client Registration (DCR) security policy management. The &#34;Allowed Protocol Mapper Types&#34; policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper&#39;s configuration remains unchanged. An attacker with client registration privileges can exploit this by first registering an allowed mapper type with a malicious configuration and then swapping it for a restricted, high-privilege mapper type (such as one that hardcodes administrative roles). This allows the attacker to gain full administrative access to the Keycloak realm.</p> https://cve.radiocsirt.org/vuln/cve-2026-15572