CVE-2026-9704

Modified Modified - Updated After Analysis

Privilege Escalation in Keycloak via JWT Token Handling

Publication date: 2026-05-27

Last updated on: 2026-06-26

Assigner: Red Hat, Inc.

Description

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-26

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-9704

EUVD

EUVD-2026-32300

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	build_of_keycloak	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability exists in Keycloak and involves an authenticated user with low privileges sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint.

If the token exceeds 4000 characters, it is silently dropped by the system.

As a result, the system falls back to using client credentials, which allows the user to gain the permissions of the client's service account.

This leads to privilege escalation, meaning the user can perform actions beyond their intended access level.

Impact Analysis

This vulnerability can allow a low-privileged authenticated user to escalate their privileges by gaining the permissions of the client's service account.

Such privilege escalation can lead to unauthorized access to sensitive data or functionality within the system.

It increases the risk of data breaches, unauthorized actions, and potential compromise of system integrity.

Hi! I’m here to help you understand CVE-2026-9704. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70