CVE-2026-105302
Received Received - Intake

Session Note Credential Leak in Keycloak

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: redhat-SADP

Description
A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application, potentially leading to unauthorized access to the user's data on external platforms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105302
EUVD
EUVD-2026-92257

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Keycloak's User Session Note mapper. It allows a delegated client administrator to leak a user's upstream bearer tokens from external identity providers into tokens issued to their managed application. The issue occurs because the mapper does not validate whether session notes contain sensitive internal credentials like federated access tokens.

Detection Guidance

Check Keycloak logs for unusual session note mappings or token leaks. Review OIDC client configurations for unauthorized mappers copying internal session notes. Inspect issued tokens for unexpected claims containing 'FEDERATED_ACCESS_TOKEN' or 'FEDERATED_REFRESH_TOKEN'.

Impact Analysis

An attacker with delegated administrative permissions could gain unauthorized access to your data on external platforms by retrieving your upstream bearer tokens. This could allow them to access your account information or perform actions on your behalf through the external identity provider.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate compliance requirements under GDPR and HIPAA. Exposure of personal or health information could result in legal penalties and reputational damage.

Mitigation Strategies

Disable session token storage in Identity Brokering API v1 if enabled. Restrict Fine-Grained Admin Permissions (FGAP) to only trusted administrators. Audit and remove any OIDC client mappers copying internal session notes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart