Keycloak: Authorization bypass via hardcoded-claim mapper manipulation (CVE-2026-97847)

A security flaw exists in Keycloak concerning its protocol mapper and identity resolution logic. An attacker who possesses limited client management permissions can configure hardcoded-claim mappers to override identity claims within sessionless service-account tokens. Because these tokens do not contain a session ID, Keycloak fails to validate the claim integrity against an active session, leading to the misidentification of the token bearer as a highly privileged user, such as a realm administrator. This allows the attacker to obtain full control over the target realm.

Impact

Successful exploitation allows a low-privileged user with client management rights to escalate privileges to a realm administrator. This grants the attacker full control over the impacted realm, including user management, configuration changes, and access to all protected resources within that realm.

Recommendation

• Inventory all Keycloak instances within the environment.
• Review current client configurations, specifically looking for anomalous usage of hardcoded-claim mappers within service-account token requests.
• Apply security patches for CVE-2026-97847 as soon as they are made available by Red Hat.
• Audit administrative role assignments and service account permissions to ensure the principle of least privilege is maintained for client managers.