REDHAT-BUG-2481877: Medium severity Red Hat Keycloak vulnerability

Published May 27, 2026

Updated

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subjecttoken JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.

Affected Software

1 affected component

Red Hat Keycloak

Event History

May 27, 2026

Data Sourced

via Red Hat·12:41 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2481877?

The severity of REDHAT-BUG-2481877 is classified as medium (4).

How do I fix REDHAT-BUG-2481877?

To fix REDHAT-BUG-2481877, ensure that application logic manages JWT tokens properly and limits their size to below 4000 characters.

Who is affected by REDHAT-BUG-2481877?

Authenticated users with low privileges may be affected by REDHAT-BUG-2481877 if they exploit the vulnerability.

What is the impact of REDHAT-BUG-2481877?

The impact of REDHAT-BUG-2481877 is that oversized subject_token JWTs are silently dropped, potentially leading to inadequate authentication mechanisms.

When was REDHAT-BUG-2481877 published?

REDHAT-BUG-2481877 was published on May 27, 2026.