CVE-2026-97847: Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
A flaw was found in Keycloak protocol mapper authorization and sessionless token identity resolution. A user holding manage-clients permission on an OIDC client can add hardcoded-claim protocol mappers that override the sub and preferredusername claims of that client service-account token. Because client-credentials tokens are sessionless by default (no sid), Keycloak reconstructs the authenticated identity from the post-mapper claims. If the sub claim is unresolvable, Keycloak falls back to the preferredusername claim and resolves the identity of a real realm administrator. Exploitation requires the attacker to have manage-clients permissions and knowledge of a realm administrator username or UUID. Successful exploitation allows the attacker to bypass the role-stripping defenses of CVE-2026-4629 by substituting the authenticated UserModel itself. An attacker can perform any action available to a realm administrator via the Admin REST API, including enumerating users, creating new users, and deleting users.
Other sources
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already hold manage-clients permission on an OIDC client. They also need to know a realm administrator's username or UUID.
What configuration creates the vulnerable path?
The issue applies to client-credentials service-account tokens, which are sessionless by default and therefore have no sid claim. A client manager must be able to add hardcoded-claim protocol mappers that override the sub and preferred_username claims.
What access can an attacker gain?
Successful exploitation causes Keycloak to resolve the token as a real realm administrator. The attacker can perform realm-administrator actions through the Admin REST API, including enumerating, creating, and deleting users.
How can I assess whether an environment is exposed?
Review OIDC clients for principals with manage-clients permission and for hardcoded-claim protocol mappers that can override sub or preferred_username on service-account tokens. Exposure also depends on whether those principals can identify a realm administrator username or UUID.