keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority

A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve t...