CVE-2026-9704 Details

A vulnerability in Keycloak allows an authenticated user with low privileges to escalate rights by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. Tokens exceeding 4000 characters are silently discarded, causing the system to revert to client credentials. This switch grants the user access to the permissions of the client's service account, facilitating unauthorized privilege escalation.

To address this vulnerability, configure Keycloak to enforce strict parameter validation by setting the 'fail-fast' parameter to 'true' for the 'TokenEndpoint' configuration. This adjustment will ensure that requests with oversized parameters are explicitly rejected instead of being silently processed with diminished privileges. Refer to the Keycloak documentation for guidance on modifying these settings, and note that a restart of the Keycloak service may be required for the changes to take effect.