CVE-2026-97847

Red Hat Build of Keycloak · Vulnerability

CVSS 3.1 7.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 5 Nov 2026 18:36:21 UTC. Read the latest advisory.

cve-program · CVE-2026-97847

Published

A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-97847

Published

keycloak-services

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Build of Keycloak",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "keycloak-services",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:"
                    ]
                }

rhbk/keycloak-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Build of Keycloak",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhbk/keycloak-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:build_keycloak:"
                    ]
                }

keycloak-services

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Single Sign-On 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "keycloak-services",
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:/a:redhat:red_hat_single_sign_on:7"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON