CVE-2026-9803

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Published

May 27, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.42% · Oct 25, 2026

A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client registration endpoint. This can lead to an ArrayIndexOutOfBoundsException, causing the server to return an HTTP 500 error and resulting in a Denial of Service (DoS) for the affected service. keycloak: Keycloak: Denial of Service via malformed Authorization header A Moderate denial of service flaw was found in Keycloak's client registration endpoints. An unauthenticated attacker can send a specially crafted request with a malformed 'Authorization: Bearer' header, causing an ArrayIndexOutOfBoundsException and an HTTP 500 error. This can lead to a temporary disruption of service for the Keycloak instance. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.