CVE-2026-9803: Keycloak: keycloak: denial of service via malformed authorization header
A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9803?
The severity of CVE-2026-9803 is classified as medium with a CVSS score of 5.3.
How do I fix CVE-2026-9803?
To fix CVE-2026-9803, ensure you update Keycloak to the latest version which addresses the vulnerability.
What is the impact of CVE-2026-9803?
CVE-2026-9803 allows remote unauthenticated attackers to cause denial of service by sending malformed authorization headers.
Can CVE-2026-9803 be exploited remotely?
Yes, CVE-2026-9803 can be exploited remotely by an attacker without authentication.
What components of Keycloak are affected by CVE-2026-9803?
CVE-2026-9803 specifically affects the ClientRegistrationAuth component of Keycloak.