Keycloak on Red Hat JSON Web Token subject_token improper validation of specified quantity in input

Summaryinfo

A vulnerability was found in Keycloak on Red Hat. It has been classified as problematic. Affected by this issue is some unknown functionality of the component JSON Web Token Handler. The manipulation of the argument subject_token leads to improper validation of specified quantity in input. This vulnerability is referenced as CVE-2026-9704. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Keycloak on Red Hat (unknown version). This issue affects an unknown code block of the component JSON Web Token Handler. The manipulation of the argument subject_token with an unknown input leads to a improper validation of specified quantity in input vulnerability. Using CWE to declare the problem leads to CWE-1284. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.

It is possible to read the advisory at access.redhat.com. The identification of this vulnerability is CVE-2026-9704 since 05/27/2026. The exploitation is known to be difficult. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/11/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-32300). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Keycloak

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion