Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
Historical advisory recorded 10 Nov 2026 00:02:10 UTC. Read the latest advisory.
cve-program · CVE-2026-97848
PublishedA flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-97848
PublishedKeycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.
- Source published
- 6 Nov 2026 06:03:03 UTC
- Source modified
- 9 Nov 2026 22:46:20 UTC
- Saved here
- 10 Nov 2026 00:02:10 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N