CVE-2026-97847

A vulnerability exists in the protocol mapper and identity resolution components of Keycloak . The flaw allows a client manager to use hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Since these tokens lack a session ID, Keycloak may incorrectly resolve ...

CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority

A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...