PT-2026-43993 · Red Hat · Keycloak

Filip Jovanov + 1 · Published 2026-05-27 · Updated 2026-06-10 · CVE-2026-9704

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description An authenticated user with low privileges can achieve privilege escalation by sending an oversized JSON Web Token (JWT), which is a compact, URL-safe means of representing claims to be transferred between two parties, to the 'TokenEndpoint'. When the subject token exceeds 4000 characters, the system silently drops it and falls back to client credentials, granting the user the permissions of the client's service account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2026-9704

Affected Products

Keycloak

References · 8

• https://access.redhat.com/errata/RHSA-2026:25098 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-9704 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9704 · Security Note
• https://access.redhat.com/errata/RHSA-2026:25097 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2481877 · Vendor Advisory
• https://t.me/cveNotify/166959 · Telegram Post
• https://t.me/cveNotify/165821 · Telegram Post
• https://twitter.com/vuldb/status/2059904148305563880 · Twitter Post