MEDIUMCVSS v3.1 6.8Vulnerability
CVE-2026-109081
A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-07T06:40:34.987550+00:00
- Epss score
- 0.00364
- Cvss severity
- MEDIUM
- Cvss score
- 6.8
- Retrieved at
- 2026-11-07T06:44:43+00:00
- Last source
- FIRST EPSS
- Score
- 6.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-109081
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- First seen by Signal
- 2026-11-06T10:16:10+00:00
- Name
- CVE-2026-109081
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
- Published at
- 2026-11-06T06:16:39.290
- Last modified
- 2026-11-06T18:17:43.157
- Epss percentile
- 0.30366
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph