CVE-2026-92857 - Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
CVE ID :CVE-2026-92857 Published : Nov. 5, 2026, 6:17 p.m. | 51 minutes ago Description :Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an...