CVE-2026-9705: Keycloak Client Re-Enablement Vulnerability (CVSS 6.5)

Technical summary

The vulnerability exists in Keycloak's client registration service and stems from insufficient validation of client state during token-based operations. An attacker in possession of a previously issued RAT can invoke registration endpoints to change the client's enabled/disabled status, bypassing the administrative action that revoked the client. The flaw is rooted in improper access control logic (CWE-613) where the service fails to enforce that disabled clients cannot be modified via legacy tokens. Upon re-enablement, the attacker can generate new credentials, effectively resetting the client secret and restoring API access without requiring fresh authorization.

Business impact

This vulnerability creates a persistent backdoor risk for organizations running Keycloak in environments where clients are disabled as a revocation mechanism. If an attacker obtains a stale RAT—through credential leakage, insecure storage, or supply-chain compromise—they can resurrect disabled OAuth 2.0/OpenID Connect clients and pivot to backend APIs or user data. The impact is particularly severe for enterprises using Keycloak as a central identity provider across microservices, as a compromised client could grant access to multiple downstream systems. Integrity of identity governance is compromised, potentially enabling privilege escalation or lateral movement.

Affected systems

Red Hat build of Keycloak is explicitly affected. Organizations running any version of Keycloak (the upstream open-source project that Red Hat packages) should assess their exposure. The vulnerability requires that an attacker has previously obtained a valid RAT, which is typically issued during client registration workflows. Environments where clients are routinely disabled rather than deleted, and where RAT rotation is not enforced, face elevated risk.

Exploitability

Exploitation is straightforward once a RAT is obtained; no authentication, user interaction, or complex configuration is required. The attack is network-accessible and requires only the ability to reach the Keycloak registration endpoint and possess a previously issued token. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects low attack complexity and no authentication barrier. However, the attack depends on prior compromise or leakage of a RAT, which somewhat constrains real-world opportunistic exploitation. Targeted attacks against known or suspected Keycloak deployments remain feasible.

Remediation

Apply vendor security patches immediately upon availability. In the interim, organizations should audit Keycloak audit logs for re-enablement of disabled clients and review all disabled clients to identify unexpected state changes. Implement strict RAT lifecycle management: enforce expiration windows, rotate tokens regularly, and revoke tokens upon client lifecycle events (disable or delete). Where possible, prefer client deletion over disabling to eliminate the attack surface. Monitor client state changes in real-time and correlate them with authentication and API access logs. Segregate Keycloak administrative interfaces behind network controls and multi-factor authentication.

Patch guidance

Consult Red Hat's security advisory for Red Hat build of Keycloak for the specific fixed version. Apply patches in a staged rollout to non-production Keycloak instances first, verifying that existing client integrations remain functional and that no new client state anomalies appear. Ensure that all Keycloak instances in your deployment (including replicas and disaster-recovery nodes) are patched synchronously. Post-patch, review and reset the secrets of any clients that were disabled during the vulnerability window to eliminate residual risk from exposed credentials.

Detection guidance

Monitor Keycloak's event logs and audit trail for client state transitions, particularly re-enablement events. Alert on any client moving from disabled to enabled status, especially if triggered by a registration endpoint invocation rather than direct administrator action. Cross-reference client re-enablement timestamps with user authentication logs and API access patterns to identify suspicious activity. Implement network-level monitoring to detect multiple consecutive client registration API calls from the same source, which may indicate token enumeration or replay attacks. Use Keycloak's built-in metrics and logging to track RAT issuance and usage patterns; flag any RAT usage after the token's expected expiration or after client disablement.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the vulnerability is prioritized for urgent remediation because it enables persistent, post-compromise persistence. An attacker who has already breached an organization can weaponize a captured RAT to regain access even after the initial compromise vector is closed. The attack bypasses administrative controls, which is a control-plane integrity issue and a violation of the principle of least privilege. For organizations relying on Keycloak as a centralized identity fabric, this vulnerability could unlock access to a broad attack surface spanning multiple applications and services.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects the network-accessible attack vector and low complexity, but is moderated by the requirement that an attacker must already possess a valid RAT. The scoring does not fully capture the control-plane bypass and post-compromise persistence aspects, which elevate real-world risk. In contexts where RATs are long-lived or stored insecurely, the practical risk is substantially higher. Security leaders should treat this as a HIGH priority for Keycloak deployments in production identity governance roles.

Frequently asked questions