← All credits

Red Hat would like to thank Eurico Nicacio (independent) for reporting this issue.

1 vulnerability record and advisories credit this contributor.

CVE-2026-92857
Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens