{
  "cve": "CVE-2026-109081",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": null
          }
        ],
        "enrichment": {
          "confidence": 85.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 85.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "product": "keycloak",
        "vendor": "keycloak"
      }
    ],
    "created": "2026-11-06T02:45:06.882100+00:00",
    "title": "Denial of Service via Default Role Injection in Keycloak DCR",
    "updated": "2026-11-06T03:00:16.824814+00:00",
    "vendors": [
      "keycloak",
      "keycloak$PRODUCT$keycloak"
    ]
  },
  "epss": {
    "score": 0.00364
  },
  "mitre": {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:26.6::el9",
      "cpe:/a:redhat:red_hat_single_sign_on:7"
    ],
    "created": "2026-11-06T05:57:29.220000+00:00",
    "description": "A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 6.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/109xxx/CVE-2026-109081.json",
    "references": [
      "https://access.redhat.com/errata/RHSA-2026:95761",
      "https://access.redhat.com/security/cve/CVE-2026-109081"
    ],
    "title": "Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint",
    "updated": "2026-11-06T10:28:26.584000+00:00",
    "vendors": [
      "redhat",
      "redhat$PRODUCT$build_keycloak",
      "redhat$PRODUCT$red_hat_single_sign_on"
    ],
    "weaknesses": [
      "CWE-862"
    ]
  },
  "nvd": {
    "cpes": [],
    "created": "2026-11-06T06:16:39.290000+00:00",
    "description": "A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 6.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-109081.json",
    "references": [
      "https://access.redhat.com/errata/RHSA-2026:95761",
      "https://access.redhat.com/security/cve/CVE-2026-109081"
    ],
    "title": null,
    "updated": "2026-11-06T11:17:03.837000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-862"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-11-06T00:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "added": [
                "CWE-862"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://nvd.nist.gov/vuln/detail/CVE-2026-109081",
                "https://www.cve.org/CVERecord?id=CVE-2026-109081"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 6.8,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"
                }
              },
              "removed": {},
              "updated": {
                "threat_severity": {
                  "new": "Moderate",
                  "old": null
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "aa1b712c-2367-4030-b125-45227332f792"
      },
      {
        "created": "2026-11-06T03:00:00+00:00",
        "data": [
          {
            "details": [
              "keycloak",
              "keycloak$PRODUCT$keycloak"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "keycloak",
                "keycloak$PRODUCT$keycloak"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "970424d8-ca48-4247-af21-9994add7b01c"
      },
      {
        "created": "2026-11-06T03:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Denial of Service via Default Role Injection in Keycloak DCR",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "74569f4d-c6f9-47f3-b805-b7e83a5f85d5"
      },
      {
        "created": "2026-11-06T06:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint",
              "old": "Denial of Service via Default Role Injection in Keycloak DCR"
            },
            "type": "title"
          },
          {
            "details": [
              "redhat",
              "redhat$PRODUCT$build_keycloak",
              "redhat$PRODUCT$red_hat_single_sign_on"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:/a:redhat:build_keycloak:",
                "cpe:/a:redhat:red_hat_single_sign_on:7"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "redhat",
                "redhat$PRODUCT$build_keycloak",
                "redhat$PRODUCT$red_hat_single_sign_on"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/security/cve/CVE-2026-109081"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "0f4abf23-cd11-45b1-a1a4-dadb96e84388"
      },
      {
        "created": "2026-11-06T10:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:/a:redhat:build_keycloak:26.6::el9"
              ],
              "removed": [
                "cpe:/a:redhat:build_keycloak:"
              ]
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "https://access.redhat.com/errata/RHSA-2026:95761"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "2bb42fd4-9b28-45cf-a9b6-024875e8f05e"
      }
    ],
    "cpes": {
      "data": [
        "cpe:/a:redhat:build_keycloak:26.6::el9",
        "cpe:/a:redhat:red_hat_single_sign_on:7"
      ],
      "providers": [
        "mitre"
      ]
    },
    "created": {
      "data": "2026-11-05T00:00:00+00:00",
      "provider": "redhat"
    },
    "description": {
      "data": "A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 6.8,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00364
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {},
        "provider": null
      },
      "threat_severity": {
        "data": "Moderate",
        "provider": "redhat"
      }
    },
    "references": {
      "data": [
        "https://access.redhat.com/errata/RHSA-2026:95761",
        "https://access.redhat.com/security/cve/CVE-2026-109081",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-109081",
        "https://www.cve.org/CVERecord?id=CVE-2026-109081"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    },
    "title": {
      "data": "Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-11-06T10:28:26.584000+00:00",
      "provider": "mitre"
    },
    "vendors": {
      "data": [
        "keycloak",
        "keycloak$PRODUCT$keycloak",
        "redhat",
        "redhat$PRODUCT$build_keycloak",
        "redhat$PRODUCT$red_hat_single_sign_on"
      ],
      "providers": [
        "mitre",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-862"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    }
  },
  "redhat": {
    "cpes": [],
    "created": "2026-11-05T00:00:00+00:00",
    "description": "A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 6.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H"
      },
      "threat_severity": "Moderate"
    },
    "redhat_repo_path": "2026/CVE-2026-109081.json",
    "references": [
      "https://nvd.nist.gov/vuln/detail/CVE-2026-109081",
      "https://www.cve.org/CVERecord?id=CVE-2026-109081"
    ],
    "title": null,
    "updated": "2026-11-05T00:00:00+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-862"
    ]
  }
}