ECHO-1969-C688-A45C Keycloak's GHSA advisory (GHSA-rr5q-3xwr-f323) lists the affected range as < 26.6.3 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerability requires a generic parameter-length-limiting mechanism (OIDCProviderConfig's max-length-per-parameter config, TokenEndpoint's checkParameters() gate) that silently drops any oversized request parameter, including subject_token — the fix exempts token-shaped parameters from that drop via a new getTokenParameterNames() method. That length-limiting framework does not exist anywhere in 25.0.6 (same finding as CVE-2026-4634, investigated separately) — confirmed via source search, no getMaxLengthForTheParameter/checkParameters/length-cap mechanism exists on any OIDC grant-type endpoint. With no mechanism to silently drop an oversized subject_token, the described fallback to client-credentials cannot occur.

Bulletin has no description...