Keycloak CVE-2026-105302

Exploitation requires (1) an attacker holding a delegated/scoped client-administrator privilege able to configure protocol mappers on a client, (2) Keycloak deployed with federated external identity providers whose upstream access/bearer tokens are stored and exposable as user session notes, and (3) a victim user actually authenticating to the attacker-controlled managed application (UI:R) so a token containing the sensitive note is issued. The flaw is the User Session Note mapper's failure to validate that the requested session note is not a sensitive internal credential. Limiting factors: it is not remote-unauthenticated - it needs administrative rights over a client plus active victim interaction, and it only has impact where external-IdP token storage/federation is configured; default deployments without federated token storage are not exposed.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N, base 5.7) correctly reflects a confidentiality-only flaw that is gated by two real barriers: the attacker must already hold a delegated client-administrator privilege (PR:L) and a victim user must interact by authenticating to the attacker-controlled managed application (UI:R). There is no integrity or availability impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so by the precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active exploitation or weaponization. The privileged-insider nature (a trusted-but-scoped delegated admin abusing mapper configuration) makes this a targeted/abuse-of-trust scenario rather than a mass-exploitable internet-facing bug, which is consistent with the sub-6 CVSS. One signal worth verifying: the real-world impact can exceed the C:H/S:U rating because the leaked upstream bearer tokens grant access to a SEPARATE external platform (the user's data on an external IdP), which is arguably a scope change (S:C) - the blast radius extends beyond Keycloak itself. Overall: a real, patch-worthy privilege-abuse/token-leak issue for anyone running Keycloak with federated external IdPs and delegated client administration, but lower operational urgency than a network-unauthenticated RCE.

A delegated client administrator - trusted to manage one application but not fully trusted with the realm - configures a User Session Note protocol mapper on their client to request a session note that actually holds a federated access token from an external identity provider. When a targeted user logs in to that managed application, Keycloak mints a token containing the user's upstream bearer token, which the administrator then extracts and replays against the external platform to access the victim's data there. No public exploit code was identified in the provided data; exploitation requires the attacker to hold client-admin rights and a victim to authenticate (UI:R).