CVE-2026-9803

MEDIUM 5.3

Keycloak: keycloak: denial of service via malformed authorization header

CVSS Score

5.3

EPSS Score

0.1%

EPSS Percentile

22th

A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service.

CWE	CWE-125
Vendor	red hat
Product	red hat build of keycloak
Published	May 28, 2026
Last Updated	May 28, 2026

Stay Ahead of the Next One

Get instant alerts for red hat red hat build of keycloak

Be the first to know when new medium vulnerabilities affecting red hat red hat build of keycloak are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

Red Hat / Red Hat Build of Keycloak

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-9803 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2482465

Credits

Red Hat would like to thank Mustafa Çetin for reporting this issue.