Token Sanitization Flaw in Keycloak Identity and Access Management Solution
CVE-2026-97848

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
6 November 2026

What is CVE-2026-97848?

A security flaw exists in the token sanitization mechanism of Keycloak, an open-source identity and access management solution. This vulnerability arises when a protocol mapper emits structured claims utilizing the JSON type. The implemented security check intended to remove unauthorized role mappings is limited to standard Java maps and fails to account for Jackson-based JSON objects. Consequently, this oversight permits malicious actors to inject falsified client roles into the security tokens, potentially leading to unauthorized access to restricted resources.

References

https://access.redhat.com/security/cve/CVE-2026-97848
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2540960
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Katika Mohaseen (GitHub: h1-mrz) for reporting this issue.
.