Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim m…

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.

Etkilenen sürümler2 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-97847 Diğer

Kayıt geçmişi

1. 5 Kas 2026 20:16Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
• 6,8 CVE-2026-97174Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
• 8,0 CVE-2026-96453Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
• 7,4 CVE-2026-93998Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
• 8,1 CVE-2026-92857Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
• 7,4 CVE-2026-92855Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possession