Bug 2540950 (CVE-2026-97847)

Summary: CVE-2026-97847 keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-12-23   

Description OSIDB Bzimport 2026-09-25 05:58:15 UTC 
A flaw was found in Keycloak protocol mapper authorization and sessionless token identity resolution. A user holding manage-clients permission on an OIDC client can add hardcoded-claim protocol mappers that override the sub and preferred_username claims of that client service-account token. Because client-credentials tokens are sessionless by default (no sid), Keycloak reconstructs the authenticated identity from the post-mapper claims. If the sub claim is unresolvable, Keycloak falls back to the preferred_username claim and resolves the identity of a real realm administrator.
Exploitation requires the attacker to have manage-clients permissions and knowledge of a realm administrator username or UUID. Successful exploitation allows the attacker to bypass the role-stripping defenses of CVE-2026-4629 by substituting the authenticated UserModel itself. An attacker can perform any action available to a realm administrator via the Admin REST API, including enumerating users, creating new users, and deleting users.