Description

A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-05T18:17:11.840Z",
  "pubdate": "2026-11-05T18:17:11.840Z",
  "executiveSummary": "A critical vulnerability exists within the Keycloak protocol mapper and identity resolution components, specifically affecting the processing of sessionless service-account tokens.\nThe flaw allows a malicious actor with limited client management permissions to manipulate hardcoded-claim mappers, resulting in unauthorized identity elevation.\nBy overriding identity claims within these tokens, an attacker can trick the system into resolving the token bearer as an arbitrary, highly privileged user, such as a realm administrator.\nThis vulnerability leads to full account takeover and total compromise of the affected realm.\nThe exploit leverages the absence of session IDs in service-account tokens to bypass standard validation mechanisms that usually bind tokens to specific user sessions.\nThe risk is categorized as high, as it grants full administrative control to an otherwise restricted user, fundamentally breaking the Identity and Access Management (IAM) trust boundary.\nExploitation requires the attacker to possess sufficient privileges to configure or modify client-level protocol mappers within the Keycloak environment.",
  "technicalDetails": "The vulnerability resides in the interaction between the protocol mapper subsystem and the identity resolution logic when processing sessionless service-account tokens in Keycloak.\nIn Keycloak, service accounts are utilized for machine-to-machine communication, and their tokens are often stateless, lacking a persistent session ID typically found in user-initiated sessions.\nThe root cause is an insecure identity resolution mechanism that trusts claims manipulated via hardcoded-claim mappers without adequate validation of the subject's authorization context.\nAttackers with client management permissions can define or modify hardcoded-claim mappers for a client. When a service-account token is issued, these mappers inject predefined claims into the token payload.\nBecause the identity resolution logic fails to verify the integrity of the subject identity against the sessionless token's origin, it processes the injected claims as authoritative.\nThe attack flow proceeds as follows: 1) The attacker identifies a target client or creates a new one where they possess management authority. 2) The attacker configures a hardcoded-claim mapper to inject identity claims (e.g., subject identifiers or administrative roles) into the service-account token generation process. 3) The attacker requests a service-account token for the managed client. 4) Keycloak generates the token, incorporating the malicious claims due to the mapper configuration. 5) Upon presentation of the token to the identity resolution component, the system incorrectly validates the bearer based on the manipulated claims rather than the actual service account principal. 6) The system resolves the bearer to the high-privileged identity (e.g., a realm administrator).\nThis behavior allows the attacker to effectively forge the identity of an administrator, bypassing the intended security posture of the service account.\nThe lack of a session ID in this token type eliminates the protection layer that would normally prevent identity swapping in stateful sessions, as there is no session-binding to validate against the claims' veracity.\nThe post-exploitation impact is catastrophic, as the attacker achieves full realm control, enabling them to modify security settings, create unauthorized users, access sensitive data, or compromise additional downstream services linked to the realm."
}