CVE-2026-9704— Keycloak: keycloak: privilege escalation due to oversized subject_token jwt
Quick assessment
Affected
Red Hat Red Hat build of Keycloak 26.4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Keycloak是Keycloak开源的一种开源身份和访问管理解决方案。 Keycloak存在安全漏洞，该漏洞源于经过身份验证的低权限用户可通过向TokenEndpoint发送过大的subject_token JWT令牌，当令牌超过4000字符限制时被静默丢弃，系统回退到客户端凭据，导致用户获得客户端服务账户的权限，实现权限提升。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.13-1< * |
unaffected |
26.4-19< * |
unaffected | ||
26.4-19< * |
unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.4.13 | any |
unaffected |
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.3-3< * |
unaffected |
26.6-6< * |
unaffected | ||
26.6-6< * |
unaffected | ||
| Red Hat | Red Hat build of Keycloak 26.6.3 | any |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-9704
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keycloak: keycloak: privilege escalation due to oversized subject_token jwt
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5
Vulnerability Title
Keycloak 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Keycloak是Keycloak开源的一种开源身份和访问管理解决方案。 Keycloak存在安全漏洞，该漏洞源于经过身份验证的低权限用户可通过向TokenEndpoint发送过大的subject_token JWT令牌，当令牌超过4000字符限制时被静默丢弃，系统回退到客户端凭据，导致用户获得客户端服务账户的权限，实现权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4.13-1 ~ * |
cpe:/a:redhat:build_keycloak:26.4::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-19 ~ * |
cpe:/a:redhat:build_keycloak:26.4::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.4 | 26.4-19 ~ * |
cpe:/a:redhat:build_keycloak:26.4::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.4.13 | - |
cpe:/a:redhat:build_keycloak:26.4::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6.3-3 ~ * |
cpe:/a:redhat:build_keycloak:26.6::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-6 ~ * |
cpe:/a:redhat:build_keycloak:26.6::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.6 | 26.6-6 ~ * |
cpe:/a:redhat:build_keycloak:26.6::el9
|
|
| Red Hat | Red Hat build of Keycloak 26.6.3 | - |
cpe:/a:redhat:build_keycloak:26.6::el9
|
|
II. Public POCs for CVE-2026-9704
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9704
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-9704 (3)
-
🔗 2481877 – (CVE-2026-9704) CVE-2026-9704 keycloak: Keycloak: Privilege escalation due to oversized subject_token JWT Read full article issue-tracking x_refsource_REDHAT
-
-
Other References for CVE-2026-9704 (3)
Same Patch Batch · Red Hat · 2026-05-27 · 5 CVEs total
| CVE-2026-3012 | 8.0 HIGH | Samba: group policy certificate enrollment uses http:// without validation |
| CVE-2026-1933 | 7.1 HIGH | Samba: missing access check on reparse point operations |
| CVE-2026-2340 | 6.5 MEDIUM | Samba: vfs_worm does not block directory modification |
| CVE-2026-9689 | 4.2 MEDIUM | Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows |
IV. Related Vulnerabilities
Same product: Red Hat build of Keycloak 26.4
-
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated accoun -
CVE-2026-15572
Keycloak-services: keycloak-services: dcr protocol mapper ty -
CVE-2026-16442
Keycloak-services: keycloak-services: saml idp-initiated bro -
CVE-2026-16071
Keycloak-services: keycloak-services: ldap entry-dn user sea -
CVE-2026-16102
Keycloak-services: keycloak-services: default dcr policy all
Same vendor: Red Hat
-
CVE-2026-80158
Ansible-collection-community-general: community.general: ipa -
CVE-2026-79654
Ketello: katello content view history api cross-organization -
CVE-2026-80185
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent- -
CVE-2026-80186
Bluez: stack overflow in name2utf8 causes dos and potential -
CVE-2026-77680
Libsoup3: libsoup: quadratic cpu denial of service in http r
Same weakness: CWE-1284
-
CVE-2026-45201
GPU DDK - Incorrect page size validation in PhysmemNewRamBac -
CVE-2026-77640
Tor <0.4.9.9 zlib截断流无限循环漏洞 -
CVE-2026-75897
Uncontrolled Resource Consumption in Capabilities Route in O -
CVE-2026-66679
WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken -
CVE-2026-73194
DBI versions before 1.652 for Perl allow a heap out-of-bound
V. Comments for CVE-2026-9704
No comments yet