SecuriTricks - CVE-2026-9704

Description

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.

Product(s) Impacted

Vendor	Product	Versions
Keycloak	Keycloak	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-1284

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	keycloak	keycloak	/	/	/	/	/	/	/	/

References

https://access.redhat.com/security/cve/CVE-2026-9704

https://bugzilla.redhat.com/show_bug.cgi?id=2481877

CVSS Score

6.8 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

View Vector String

Timeline

Published: May 27, 2026, 2:17 p.m.
Last Modified: May 27, 2026, 2:54 p.m.

Status : Undergoing Analysis

CVE is currently being analyzed by NVD staff, this process results in association of reference link tags, CVSS scores, CWE association, and CPE applicability statements.

More info

Source

[email protected]

CVE-2026-9704