{"id":"CVE-2026-96547","aliases":[],"cve":{"records":[{"id":"CVE-2026-96547","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-23T12:37:20.092Z","published":"2026-11-06T06:02:59.384Z","modified":"2026-11-10T19:40:51.132Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T17:32:56.678Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T19:40:51.132Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:95759","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95760","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95761","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95762","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96547","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539387","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"}],"weaknesses":[{"id":"CWE-862","description":"Missing Authorization","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T19:40:36.503643Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in the Dynamic Client Registration component of Keycloak, an open-source identity and access management solution. The issue occurs because the system does not properly restrict which claim names can be used when setting up new clients. An attacker with valid registration credentials could create a client that incorrectly maps standard user profile information to sensitive security roles, potentially allowing them to gain unauthorized privileges on external applications that trust Keycloak tokens.","score":6.5,"severity":"medium","published":"2026-11-06T06:02:59.384Z","modified":"2026-11-10T19:40:51.132Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4","platforms":[],"versions":[{"version":"26.4.17-2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4","platforms":[],"versions":[{"version":"26.4-29","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4","platforms":[],"versions":[{"version":"26.4-30","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4.17","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4.17","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6","platforms":[],"versions":[{"version":"26.6.8-2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6","platforms":[],"versions":[{"version":"26.6-24","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6","platforms":[],"versions":[{"version":"26.6-24","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6.8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6.8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"},{"vendor":"Red Hat","name":"Red Hat Single Sign-On 7","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"}],"references":["https://access.redhat.com/errata/RHSA-2026:95759","https://access.redhat.com/errata/RHSA-2026:95760","https://access.redhat.com/errata/RHSA-2026:95761","https://access.redhat.com/errata/RHSA-2026:95762","https://access.redhat.com/security/cve/CVE-2026-96547","https://bugzilla.redhat.com/show_bug.cgi?id=2539387"],"sources":[{"name":"CVE","id":"CVE-2026-96547","modified":"2026-11-10T19:40:51.132Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-10T20:34:22.396Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:10:30.655Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T09:15:46.756Z","attemptedAt":"2026-11-06T09:15:46.756Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T09:15:45.169Z","attemptedAt":"2026-11-06T09:15:45.169Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T09:15:46.735Z","attemptedAt":"2026-11-06T09:15:46.735Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-06T09:15:46.017Z","attemptedAt":"2026-11-06T09:15:46.017Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-x8ch-fp9w-fgvx","url":"https://github.com/advisories/GHSA-x8ch-fp9w-fgvx","modified":"2026-11-06T06:30:30Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-11-06T09:15:45.169Z"},{"source":"ENISA EUVD","id":"EUVD-2026-117921","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117921","modified":"Nov 6, 2026, 6:02:59 AM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-11-06T09:15:46.735Z"},{"source":"NVD","id":"CVE-2026-96547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96547","modified":"2026-11-06T06:16:45.337","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","checkedAt":"2026-11-06T09:15:46.756Z"}],"aiSummary":{"text":"A flaw in Keycloak's Dynamic Client Registration component allows an attacker with valid registration credentials to create a client that incorrectly maps user profile information to sensitive security roles, potentially gaining unauthorized privileges. The affected product is Red Hat build of Keycloak. The required attacker access is valid registration credentials.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T18:01:45.262Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-96547"}]}}