EUVD-2026-32300
GHSA-rr5q-3xwr-f323
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.
AnalysisAI
Privilege escalation in Keycloak exposes service account permissions to authenticated low-privilege users through a silent JWT size-check failure at the TokenEndpoint. When a subject_token JWT exceeding 4000 characters is submitted, Keycloak silently discards it and falls back to client credentials - granting the attacker the permissions of the client's service account without any explicit authorization decision. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today