CVE-2026-97847
A flaw was found in the protocol mapper and identity resolution components of Keycloak.
Impact
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
An attacker can exploit this over the network, with a regular user account, without any action by a user. Specific conditions have to be met, which makes an attack harder. If it succeeds: high risk of data being read, high risk of data or systems being changed, low risk of outages.
Affected products · Red Hat
| Product | Affected versions |
|---|---|
| Red Hat build of Keycloak 26.4 | Versions patch: 26.4.17-2, patch: 26.4-29, patch: 26.4-30 |
| Red Hat build of Keycloak 26.6 | Versions patch: 26.6-24, patch: 26.6.8-2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2026:95759
- https://access.redhat.com/errata/RHSA-2026:95760
- https://access.redhat.com/errata/RHSA-2026:95761
- https://access.redhat.com/errata/RHSA-2026:95762
- https://access.redhat.com/security/cve/CVE-2026-97847
- https://bugzilla.redhat.com/show_bug.cgi?id=2540950