CVE-2026-9705 Details

A vulnerability exists in Keycloak's client registration service, allowing remote attackers with a valid Registration Access Token (RAT) to re-enable clients that have been disabled by administrators. This exploitation bypasses security measures, enabling attackers to reset the client's secret and potentially restore access to privileged APIs. The vulnerability primarily leads to unauthorized information disclosure and could compromise the integrity of the application.

To mitigate this vulnerability, restrict network access to the Keycloak Dynamic Client Registration endpoint. Configure network firewalls to allow connections only from trusted hosts or networks that require access to this functionality, thereby limiting exposure to unauthorized access attempts.