CVE-2026-15572 is a Keycloak Dynamic Client Registration (DCR) bypass where the "Allowed Protocol Mapper Types" security policy fails to re-validate mapper types during client updates when the configuration appears unchanged. The vulnerability stems from an optimization that skips re-validation if the update request doesn't modify the relevant field—under the assumption that prior validation still holds. This creates a two-phase attack: register a client with an allowed mapper type, then exploit the update path where the system assumes its original validation decision is still valid without re-checking.
If you're running Keycloak, the immediate priority is determining whether you have DCR enabled and whether the Allowed Protocol Mapper Types policy is actually configured. This matters because the policy isn't always enabled by default—your exposure depends on both the code flaw AND your configuration. Check your realm settings for Dynamic Client Registration, look for any "Allowed Protocol Mapper Types" policy in your client registration policies, and audit which mapper types are permitted.
The deeper concern is whether this conditional re-validation pattern exists in other DCR policies. Scope policies, redirect URI restrictions, and access token settings may have similar logic—if the update request doesn't touch those fields, does the system re-validate them? Assume it doesn't until you've verified each policy individually. The attack surface isn't just this one mapper types restriction; it's the pattern of trusting update operations less rigorously than create operations.
The practical remediation is two-layered: first, verify your current DCR policy configuration and enable stricter enforcement if you haven't already. Second, treat any update to DCR policies as a security boundary event—don't assume that because a client was registered securely, its updates maintain that security. Review your client update flows for similar conditional validation patterns.