org.keycloak:keycloak-authz-policy-common (2.4.0.cr1), org.keycloak:keycloak-authz-policy-drools (2.4.0.cr1) +12 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (2.4.0.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.4.0.cr1 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.8, <=1.3.9), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.8, <=1.3.9) +31 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (14.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.8, =1.3.8, =1.3.8,...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.3), com.github.vzakharchenko:cisco-radius-plugin (1.4.3) +32 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (17.0.1)

org.keycloak:keycloak-server-spi-private MAVEN version 17.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.3 -...

com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider (1.0.0), io.github.pckhoi.keycloak:webhook (19.0.2.1) +19 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (19.0.2)

org.keycloak:keycloak-services MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.markstickel.keycloak:keycloak-kafka-publisher-event-listener-provider 1.0.0 -...

org.keycloak:keycloak-dependencies-server-min (4.8.2.final), org.keycloak:keycloak-model-jpa (4.8.2.final) +2 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (4.8.2.final)

org.keycloak:keycloak-services MAVEN version 4.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.8.2.final - org.keycloak:keycloak-model-jpa...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.5.6-24.0, <=2.7.4-24.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0, <=2.7.4-24.0) +57 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (24.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.5.6-24.0, =2.5.6-24.0,...

com.kleegroup.accelerator:accelerator-message-keycloakbrevo (>=1.0.1, <=1.0.2), com.kleegroup.accelerator:accelerator-security-keycloakmfa (1.0.1) +17 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (24.0.3)

org.keycloak:keycloak-services MAVEN version 24.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.kleegroup.accelerator:accelerator-message-keycloakbrevo =1.0.1, =1.4.7, =1.4.8 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.3), com.github.vzakharchenko:cisco-radius-plugin (1.4.3) +24 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (17.0.1)

org.keycloak:keycloak-services MAVEN version 17.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.3 -...

cn.sparrowmini:sparrow-keycloak-adapter (>=0.0.1, <=0.0.2), de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.10.9-21.1.1, <=0.11.4-21.1.1) +78 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (21.1.1)

org.keycloak:keycloak-server-spi-private MAVEN version 21.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - cn.sparrowmini:sparrow-keycloak-adapter =0.0.1, =0.10.9-21.1.1, =0.10.9-21.1.1...

org.keycloak:keycloak-authz-policy-drools (3.3.0.final), org.keycloak:keycloak-dependencies-server-all (3.3.0.final) +6 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (3.3.0.final)

org.keycloak:keycloak-services MAVEN version 3.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.3.0.final -...

GHSA-RR5Q-3XWR-F323 Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subjecttoken JSON Web Token JWT to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client...

org.keycloak:keycloak-authz-policy-common (3.4.0.final), org.keycloak:keycloak-authz-policy-drools (3.4.0.final) +13 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (3.4.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 3.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.4.0.final -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.1, <=1.3.2), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.1, <=1.3.2) +21 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (12.0.1)

org.keycloak:keycloak-services MAVEN version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =1.3.1,...

org.keycloak:keycloak-account-freemarker (1.1.0.beta1), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta1) +1 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (1.1.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta1 -...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

CVE-2026-9704

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subjecttoken JSON Web Token JWT to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +223 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.6.2)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =1.4.11 - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak 24.3.0.0 and more Source cves: CVE-2026-9704 Source advisory:...

EUVD-2026-32300

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subjecttoken JSON Web Token JWT to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client...

CVE-2026-9704

Summary: CVE-2026-9704 affects Keycloak. An authenticated user with low privileges can trigger privilege escalation by sending an oversized subject_token JWT to the TokenEndpoint; if the token exceeds 4000 characters, it is silently dropped, causing the system to fall back to client credentials a...

CVE-2026-9704

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subjecttoken JSON Web Token JWT to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client...