CVE-2026-9797

A flaw in Keycloak's administrative services (org.keycloak.services.resources.admin) allows a highly privileged attacker with the 'manage-clients' role to perform privilege escalation . Attackers can exploit this by manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types...

CVE-2026-4629 Keycloak: keycloak: privilege escalation through hardcoded role mapper injection

A flaw was found in Keycloak. A highly privileged user with manage-clients permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the realm-admin role into generated tokens,...