Is CVE-2026-97848 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97848 being exploited in the wild.

How severe is CVE-2026-97848?

Medium severity, with a CVSS score of 6.5, published 6 November 2026.

Is there a fix for CVE-2026-97848?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-97848 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-97848?

Check whether you run Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97848: Keycloak token sanitization bypass in protocol mapper

CVE-2026-97848 · Severity: medium · CVSS 6.5 · Published 2026-11-06

Keycloak is an open-source identity and access management platform that controls user authentication and authorization. A flaw in its token sanitization logic allows an attacker with client registration privileges to inject forged role assignments into security tokens, potentially granting unauthorized access to protected resources. Exploitation requires existing credentials or valid initial access, but successful attacks could allow privilege escalation across integrated applications.

Technologies: Keycloak. Vendors: Keycloak.

Quick answers

Is CVE-2026-97848 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97848 being exploited in the wild.
How severe is CVE-2026-97848?: Medium severity, with a CVSS score of 6.5, published 6 November 2026.
Which products and versions are affected?: Keycloak Keycloak.
Is there a fix for CVE-2026-97848?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-97848 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-97848?: Check whether you run Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Keycloak's token sanitization logic when a protocol mapper is configured to emit structured claims with jsonType=JSON. The security check designed to remove unauthorized role mappings only recognizes standard Java maps and fails to handle Jackson ObjectNode values, allowing attackers to bypass role validation. An attacker with client registration privileges or a valid Initial Access Token can craft forged client-role mappings in signed tokens.

Affected products

Keycloak Keycloak

Timeline

2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.