Description

A flaw was found in the token sanitization logic of Keycloak, an open source identity and access management solution. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T06:16:45.540Z",
  "pubdate": "2026-11-06T06:16:45.540Z",
  "executiveSummary": "A critical security flaw exists in Keycloak's token sanitization mechanism, specifically concerning the handling of structured claims.\nThe vulnerability is categorized as an improper input validation or security control bypass, stemming from an incompatibility between security logic and data serialization formats.\nWhen protocol mappers are configured to emit structured claims using the JSON type, the application's sanitization logic fails to correctly identify and prune unauthorized role mappings within Jackson-based JSON objects.\nThis failure allows an attacker to inject forged client roles into security tokens, effectively escalating privileges and bypassing intended access controls.\nThe impact is significant, as it enables unauthorized access to protected resources and services that rely on Keycloak for identity and access management.\nExploitation requires the attacker to leverage specific protocol mapper configurations that utilize the vulnerable JSON processing path.\nThe vulnerability represents a substantial risk to systems relying on fine-grained role-based access control, as the integrity of the issued security tokens can be compromised by a malicious actor capable of influencing claims.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient depth of the token sanitization logic within Keycloak's claim processing pipeline. Specifically, the component responsible for scrubbing unauthorized role mappings is architected to perform type-checking against standard Java Map implementations.\nWhen a Keycloak protocol mapper is configured to process structured claims using the JSON type, the underlying data structure is represented via Jackson library objects rather than standard Java Maps. Because the security validation logic specifically looks for Java Map types, it fails to traverse, inspect, or sanitize the contents of these Jackson-based JSON objects.\nThis creates a discrepancy between the security policy enforcement and the data representation layer. An attacker who can influence the input to these protocol mappers can inject malicious or unauthorized client roles directly into the JSON structure.\nThe attack flow follows a predictable pattern: first, the attacker identifies or influences a protocol mapper configuration that supports structured JSON claims. Second, the attacker triggers the token issuance process while injecting forged role mappings within the JSON structure. Third, because the sanitization logic does not recognize the Jackson objects, the malicious payload bypasses the security filter entirely.\nConsequently, the final token generated by Keycloak includes the forged claims, which are subsequently trusted by downstream resource servers or protected services.\nThe vulnerability impacts the integrity of the authorization claims embedded in JSON Web Tokens (JWT) or other security token formats managed by Keycloak. Since these tokens are consumed by downstream applications to make authorization decisions, the injection of forged roles directly translates into unauthorized access to protected resources.\nThe scope of this vulnerability is limited to environments where protocol mappers are utilized to emit JSON-structured claims. It requires no specific authentication bypass itself, but rather functions as a privilege escalation vector once a user has the ability to interact with the identity provider's token issuance process. The failure is persistent across the token lifecycle as long as the malicious mapping remains active within the token generation logic."
}