CVE-2026-9705

Description

A flaw was found in Keycloak-s client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses security controls, allowing the attacker to reset the client-s secret and potentially regain privileged API access. The primary impact includes unauthorized information disclosure and potential integrity compromise.