Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, described as an out-of-bounds read when parsing a malformed 'Authorization: Bearer' header, is clearly addressed in the provided patches. The commits modify the init method within the org.keycloak.services.clientregistration.ClientRegistrationAuth class. The vulnerable code used String.split(" ") and then accessed the second element of the resulting array without verifying its length. This could lead to an ArrayIndexOutOfBoundsException if the header did not contain a space followed by a token. The patch replaces this unsafe logic with a more robust parsing mechanism that checks for the index of the space and validates the token's presence, thereby mitigating the Denial of Service risk. The identified function, org.keycloak.services.clientregistration.ClientRegistrationAuth.init, is the direct location of this flawed logic and would be the entry point for the vulnerability during runtime.
org.keycloak.services.clientregistration.ClientRegistrationAuth.initservices/src/main/java/org/keycloak/services/clientregistration/ClientRegistrationAuth.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | <= 26.4.7 | |
| org.keycloak:keycloak-services | maven | >= 26.5.0, < 26.6.3 | 26.6.3 |