CVE-2026-9704: Keycloak privilege escalation via oversized subject_token JWT

CVE-2026-9704 · Severity: medium · CVSS 6.8 · Published 2026-05-27

Keycloak, an open-source identity and access management solution, is vulnerable to a flaw that allows low-privileged users to escalate their permissions. By submitting an unusually large security token, an attacker can cause the system to ignore the token and instead grant the higher-level permissions associated with the application's service account. This could allow an attacker to perform actions or access data they are not authorized to see, potentially compromising the security of the entire identity management system.

Technologies: Keycloak-Services, org.keycloak:keycloak-server-spi-private (Maven), org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak, Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-9704 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9704 being exploited in the wild.
How severe is CVE-2026-9704?
Medium severity, with a CVSS score of 6.8, published 27 May 2026.
Which products and versions are affected?
Keycloak-Server-Spi-Private < 26.6.3; Keycloak-Services < 26.6.3; org.keycloak:keycloak-server-spi-private (Maven) < 26.6.3, ECOSYSTEM:introduced=0,fixed=26.6.3; org.keycloak:keycloak-services (Maven) < 26.6.3, ECOSYSTEM:introduced=0,fixed=26.6.3; and 1 more.
Is there a fix for CVE-2026-9704?
Yes. org.keycloak:keycloak-server-spi-private (Maven): upgrade to 26.6.3 or later; org.keycloak:keycloak-services (Maven): upgrade to 26.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9704 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9704?
Check whether you run Keycloak-Server-Spi-Private, Keycloak-Services, org.keycloak:keycloak-server-spi-private (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-server-spi-private (Maven): upgrade to 26.6.3 or later
    # set org.keycloak:keycloak-server-spi-private to 26.6.3 in your pom.xml or build.gradle
  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.3 or later
    # set org.keycloak:keycloak-services to 26.6.3 in your pom.xml or build.gradle

Technical details

A privilege escalation vulnerability exists in Keycloak's TokenEndpoint due to improper validation of input length (CWE-1284). An authenticated attacker with low privileges can provide a 'subject_token' JSON Web Token (JWT) exceeding 4000 characters. When this limit is reached, the system silently drops the token and fails back to using the client's service account credentials. This allows the attacker to inherit the permissions of the client's service account. The attack requires network access and has high complexity due to the specific conditions required for the fallback mechanism to trigger privilege escalation. The issue is fixed in Keycloak version 26.6.3.

Affected products

  • Keycloak Keycloak server-spi-private < 26.6.3
  • Keycloak Keycloak services < 26.6.3
  • Red Hat Red Hat build of Keycloak 26.4, 26.6

Identifiers

  • CVE-2026-9704
  • GHSA-rr5q-3xwr-f323

Timeline

  • 2026-05-27: disclosed
  • 2026-05-27: advisory
  • 2026-06-10: patched: Red Hat released security advisory RHSA-2026:25098

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.