A flaw was found in Keycloak protocol mapper authorization and sessionless token identity resolution. A user holding manage-clients permission on an OIDC client can add hardcoded-claim protocol mappers that override the sub and preferred_username claims of that client service-account token. Because client-credentials tokens are sessionless by default (no sid), Keycloak reconstructs the authenticated identity from the post-mapper claims. If the sub claim is unresolvable, Keycloak falls back to the preferred_username claim and resolves the identity of a real realm administrator.
Exploitation requires the attacker to have manage-clients permissions and knowledge of a realm administrator username or UUID. Successful exploitation allows the attacker to bypass the role-stripping defenses of CVE-2026-4629 by substituting the authenticated UserModel itself. An attacker can perform any action available to a realm administrator via the Admin REST API, including enumerating users, creating new users, and deleting users.