Description

A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-11-06T06:16:39.290Z",
  "pubdate": "2026-11-06T06:16:39.290Z",
  "executiveSummary": "A critical vulnerability exists in the Keycloak Dynamic Client Registration (DCR) endpoint involving improper authorization checks on the deprecated 'defaultRoles' configuration field.\nThe vulnerability allows an authenticated attacker possessing client creation privileges or a valid Initial Access Token (IAT) to perform unauthorized modifications to the realm's global default roles.\nBy injecting an excessive number of roles into the configuration, an attacker can induce a Denial of Service (DoS) condition. This occurs because the resulting bloated access tokens exceed typical resource limits, leading to significant memory and performance degradation across the entire Keycloak realm.\nThis flaw represents a serious security risk as it affects the availability and stability of the authentication service. The exploitation requires the attacker to have at least minimal legitimate access to the DCR interface, highlighting a failure in input validation and privilege enforcement within the client management subsystem.\nThe impact is primarily environmental, potentially leading to service unavailability for all users within the affected realm due to exhausted server resources.",
  "technicalDetails": "The vulnerability resides within the Keycloak Dynamic Client Registration (DCR) endpoint, specifically in the logic handling the deprecated 'defaultRoles' attribute. In a standard secure configuration, the modification of realm-wide default roles should be restricted to high-privileged administrators. However, the DCR process fails to enforce these authorization constraints when processing client registration requests containing the 'defaultRoles' parameter.\nThe attack flow commences when an authenticated attacker or a holder of a valid Initial Access Token (IAT) submits a specially crafted JSON payload to the DCR endpoint. This payload includes the 'defaultRoles' field populated with a vast, arbitrary list of role names. Because the endpoint does not properly validate that the requester possesses the authority to modify realm-level settings, the application proceeds to update the realm’s default roles configuration with the attacker-supplied data.\nOnce the malicious roles are persisted in the realm's configuration, every subsequent authentication request across the entire realm triggers the generation of access tokens that include these injected roles. This results in 'token bloat,' where the size of the JSON Web Token (JWT) increases exponentially with every authentication event.\nThe performance and memory degradation occur during the token creation and validation phases. Keycloak and downstream applications consuming these tokens must process, sign, and parse these oversized payloads, consuming disproportionate amounts of CPU and heap memory. In high-traffic environments, this rapidly leads to resource exhaustion, elevated latency, and eventual service crashes, manifesting as a Denial of Service (DoS).\nThe root cause is a breakdown in the principle of least privilege regarding the DCR endpoint. The component responsible for processing client registration requests lacks a strict authorization check that differentiates between client-specific metadata and sensitive global realm configuration. As a result, the boundary between client registration and administrative realm configuration is effectively bypassed, allowing for the manipulation of critical state information that influences the behavior of all authenticated sessions within the realm."
}