CVE-2026-9705: Keycloak security bypass in client registration service

CVE-2026-9705 · Severity: medium · CVSS 6.5 · Published 2026-06-25

Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security flaw in its client registration service allows an attacker who has an old registration token to re-activate a client account that an administrator had previously disabled. This could allow the attacker to reset security credentials and gain unauthorized access to protected data or systems.

Technologies: Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-9705 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9705 being exploited in the wild.
How severe is CVE-2026-9705?
Medium severity, with a CVSS score of 6.5, published 25 June 2026.
Which products and versions are affected?
org.keycloak:keycloak-services (Maven) < 26.6.4, ECOSYSTEM:introduced=0,fixed=26.6.4.
Is there a fix for CVE-2026-9705?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9705 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9705?
Check whether you run Keycloak, org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later
    # set org.keycloak:keycloak-services to 26.6.4 in your pom.xml or build.gradle

Technical details

A vulnerability classified as Insufficient Session Expiration (CWE-613) exists in Keycloak's client registration service. A remote attacker possessing a previously issued Registration Access Token (RAT) can bypass administrative security controls to re-enable a client that was explicitly disabled by an administrator. By re-enabling the client, the attacker can reset the client's secret, potentially regaining privileged API access and leading to unauthorized information disclosure or integrity compromise. The attack is reachable over the network and requires the possession of a valid RAT but no other specific privileges.

Affected products

  • Red Hat Red Hat Build of Keycloak
  • Keycloak Keycloak

Identifiers

  • CVE-2026-9705
  • BIT-KEYCLOAK-2026-9705
  • GHSA-r7rc-c989-86g6

Timeline

  • 2026-05-27: other: Bug reported to Red Hat Bugzilla
  • 2026-06-25: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.