CVE-2026-97367: Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
A flaw was found in Keycloak's Account REST API session binding mechanism. The issue exists because the sid session ID claim is not included in the blocked claim list for Dynamic Client Registration DCR protocol mappers. A malicious DCR client owner can configure mappers to substitute the azp authorized party and sid claims in their access token with values derived from user-controlled profile fields. When the Account REST API processes this manipulated token, the identity token verification resolves the user session based on the provided sid without verifying that the subject sub claim in the token matches the user associated with that session. Consequently, the API returns the victim's session data. An attacker with low privileges can exploit this to read and write a victim's account profile, change the recovery email, and perform a full account takeover via password reset.
Other sources
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need before attempting exploitation?
The attacker needs low-privilege access and control of a Dynamic Client Registration client. They must be able to configure protocol mappers and use user-controlled profile fields to manipulate claims in their access token.
Does exploitation require user interaction?
Yes. The supplied CVSS vector indicates that user interaction is required, although the available information does not specify what form that interaction takes.
What condition must exist on the target account?
The targeted user must have an active session whose session ID can be referenced by the manipulated token. The described issue relies on the Account REST API resolving the victim session from the substituted sid claim.