CVE-2026-9704: Keycloak Server SPI and Services Privilege Escalation Due to Improper Token Validation
Summary
CVE-2026-9704: Keycloak Vulnerable to Improper Validation of Specified Quantity in Input. Affects org.keycloak:keycloak-server-spi-private versions < 26.6.3. Fixed in 26.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows users to secure applications and services with little to no code. It provides features such as single sign-on, identity brokering, and user federation. The Keycloak Server SPI (Service Provider Interface) and Keycloak Services are essential components that facilitate the integration and management of authentication and authorization processes. However, a vulnerability has been identified that affects these components, allowing for potential privilege escalation.
Vulnerability Detail
A flaw exists in Keycloak where an authenticated user with low privileges can exploit the system by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. If the token exceeds a 4000-character limit, it is silently dropped, causing the system to revert to client credentials. This behavior allows the user to gain the permissions of the client's service account, leading to unauthorized access and privilege escalation. The vulnerability is classified under CWE-1284, indicating improper validation of specified quantity in input.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
26.6.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation on the client-side to ensure that the size of the JWT does not exceed the acceptable limit. Additionally, monitor the TokenEndpoint for unusual activity that may indicate exploitation attempts.
Conclusion
In summary, CVE-2026-9704 is a significant vulnerability in Keycloak that can lead to privilege escalation due to improper validation of JWT tokens. It is crucial for users to update to the patched version 26.6.3 to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for org.keycloak:keycloak-server-spi-private →
FAQ
CVE-2026-9704 is a vulnerability in Keycloak that allows an authenticated user with low privileges to escalate their permissions by exploiting improper validation of oversized JWT tokens.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply analyzing your pom.xml file, Vulert can help identify if your application is affected by this vulnerability.
If exploited, this vulnerability can allow unauthorized users to gain elevated permissions, potentially leading to data breaches or unauthorized access to sensitive resources.
Update your Keycloak packages to version 26.6.3 or later by modifying your pom.xml file to include the new version for the affected dependencies.
Yes, you can implement input validation on the client-side and monitor the TokenEndpoint for any unusual activity as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-server-spi-private.
