MediumVulnerabilityCVE-2026-9705updated 29 Oct 2026, 16:36 UTC

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Fix availableOfficial source

Severity	MediumCVSS 6.5 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yesorg.keycloak:keycloak-services 26.6.4 · since 29 Oct 2026
How sure is this?	Official sourceBacked by an official source

Are you affected?

Package / product	Affected versions	Fixed in
org.keycloak:keycloak-services · maven	< 26.6.4	26.6.4

Timeline

29 Oct 2026, 16:36 UTC
Publicly disclosed
29 Oct 2026, 16:36 UTC
Reported by GitHub Advisory · GitHub Advisory
29 Oct 2026, 16:36 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenGitHub Advisory · 29 Oct 2026, 16:36 UTC

Technical details

ID: CVE-2026-9705 · GHSA-r7rc-c989-86g6
CVSS: 6.5 / 10
EPSS: 0.5% chance of exploitation within 30 days
Disclosed: 29 Oct 2026, 16:36 UTC
On Zero Radar: 29 Oct 2026, 16:36 UTC (0 min after disclosure)
Last change: 29 Oct 2026, 16:36 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Keycloak: Attacker can re-enable and take over disabled clients via registration access token · Zero Radar