CVE-2026-9704: Keycloak: keycloak: privilege escalation due to oversized subject_token jwt
A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subjecttoken JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable automatic fallback to client credentials when a subject_token is invalid, missing, or dropped. Configure the TokenEndpoint to return an error instead of switching to client credentials unless explicit, validated client credential flow is requested.
Keycloak TokenEndpoint automatic_fallback_to_client_credentials = disabled - Configuration
Enforce a maximum length for subject_token and reject requests where the subject_token parameter exceeds 4000 characters rather than silently dropping it.
Keycloak TokenEndpoint subject_token_max_length_enforcement = 4000 - Compensating control
Deploy a WAF, reverse proxy, or API gateway rule to block or return an error for requests to the TokenEndpoint that include a subject_token parameter longer than 4000 characters.
- Compensating control
Restrict access to the TokenEndpoint to trusted IP ranges or authenticated clients via firewall rules, network ACLs, or API gateway policies to reduce exposure of the endpoint.
- Operational
Audit Keycloak logs for requests containing oversized subject_token values and investigate any occurrences. If abuse is suspected, revoke impacted tokens and rotate any service account credentials that may have been abused.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9704?
CVE-2026-9704 has a medium severity rating of 6.8.
How do I fix CVE-2026-9704?
To mitigate CVE-2026-9704, restrict the size of the subject_token JWT to 4000 characters or less.
What type of vulnerability is CVE-2026-9704?
CVE-2026-9704 is a privilege escalation vulnerability that affects Keycloak.
Who can exploit CVE-2026-9704?
An authenticated user with low privileges can exploit CVE-2026-9704 by sending an oversized subject_token JWT.
What impact does CVE-2026-9704 have on Keycloak?
CVE-2026-9704 can lead to unauthorized privilege escalation by dropping oversized JWTs and falling back to client credentials.