Flaw in TokenManager of Keycloak Affects User Identity Verification
CVE-2026-96447

4.2MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
6 November 2026

What is CVE-2026-96447?

A vulnerability exists in the TokenManager of Keycloak, an open-source identity and access management platform. This flaw arises during the validation process of stateless access tokens, particularly when the original user ID has been deleted. In such cases, Keycloak mistakenly defaults to the username for identification, failing to verify the original identity associated with the token. Consequently, an attacker possessing an outdated token could potentially access a newly created service account that shares the same client ID as the previously removed user, posing a significant security risk.

References

https://access.redhat.com/security/cve/CVE-2026-96447
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2539288
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Bruno Oliveira of IBM in collaboration with OpenAI for reporting this issue.
.