CVE-2026-9704

Vulnerability

A flaw exists in Keycloak's TokenEndpoint where an oversized subject_token JWT (exceeding 4000 characters) is silently dropped, causing the server to fall back to client credentials authentication [1][2]. This allows an attacker with low-privilege authentication to bypass intended token validation and impersonate the client's service account. Affected versions include Keycloak deployments prior to a fix (details not yet disclosed).

Exploitation

An attacker must have an authenticated session with low privileges. They send a crafted subject_token JWT larger than 4000 characters to the TokenEndpoint. The server discards the oversized token and proceeds with client credentials flow, effectively promoting the attacker to the client's service account privileges [2].

Impact

Successful exploitation leads to privilege escalation: the attacker gains the permissions of the client's service account, potentially allowing unauthorized access to resources, data disclosure, or administrative actions depending on the client's role.

Mitigation

Red Hat has acknowledged the issue and is working on a fix [1]. Users should monitor for security updates and apply the patch as soon as it becomes available. No workaround has been provided; ensure timely upgrades.