Executive brief
Keycloak, an open-source identity and access management solution, is vulnerable to a flaw that allows low-privileged users to escalate their permissions. By submitting an unusually large security token, an attacker can cause the system to ignore the token and instead grant the higher-level permissions associated with the application's service account. This could allow an attacker to perform actions or access data they are not authorized to see, potentially compromising the security of the entire identity management system.
Technical details
A privilege escalation vulnerability exists in Keycloak's TokenEndpoint due to improper validation of input length (CWE-1284). An authenticated attacker with low privileges can provide a 'subject_token' JSON Web Token (JWT) exceeding 4000 characters. When this limit is reached, the system silently drops the token and fails back to using the client's service account credentials. This allows the attacker to inherit the permissions of the client's service account. The attack requires network access and has high complexity due to the specific conditions required for the fallback mechanism to trigger privilege escalation. The issue is fixed in Keycloak version 26.6.3.
Affected products
- Keycloak Keycloak server-spi-private < 26.6.3
- Keycloak Keycloak services < 26.6.3
- Red Hat Red Hat build of Keycloak 26.4, 26.6
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-06-10: patched: Red Hat released security advisory RHSA-2026:25098