42 matches found
keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks fo...
keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...
keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks fo...
keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...
CVE-2026-97848
A flaw exists in the token sanitization logic of Keycloak , an open source identity and access management solution. When a protocol mapper is configured to emit structured claims using the JSON type , the security check fails to recognize Jackson-based JSON objects because it only looks for stand...
EUVD-2026-117923
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks fo...
CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks fo...
CVE-2026-97848
A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks fo...
CVE-2026-97847
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...
EUVD-2026-117612
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...
CVE-2026-97847
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...
CVE-2026-92857 Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...
CVE-2026-92857
The Keycloak-services Dynamic Client Registration (DCR) feature contains a vulnerability where protocol mapper configurations are not validated . This flaw allows individuals holding specific tokens to register malicious applications and map their own profile details to protected fields, such as ...
PT-2026-137584
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...
BIT-KEYCLOAK-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
Privilege Escalation
Keycloak is vulnerable to Improper Authorization. The vulnerability is due to the Dynamic Client Registration policy failing to re-validate protocol mapper types during client updates, allowing an attacker with client registration privileges to replace an allowed mapper with a restricted...
keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
CVE-2026-15572
CVE-2026-15572 (Keycloak) affects Keycloak’s Dynamic Client Registration (DCR) policy management. The bug is in the "Allowed Protocol Mapper Types" policy: during a client update, if the mapper’s configuration doesn’t change, re-validation of the mapper type is skipped, enabling an attacker with ...
CVE-2026-15572
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...