Improper Validation of Specified Quantity in Input in Keycloak - CVE-2026-9704
Published: September 5, 2026
Vulnerability identifier: #VU146995
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-9704
CWE-ID: CWE-1284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper validation of specified quantity in input in the TokenEndpoint when processing an oversized subject_token JSON Web Token (JWT). A remote user can send an oversized subject_token JWT to gain the permissions of the client\'s service account and escalate privileges.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2026-9704
Install security update from vendor's website.
Keycloak - update to 26.6.3
Red Hat build of Keycloak - addressed in versions 26.4.13, 26.6.3
Red Hat build of Keycloak - addressed in versions 26.4.13, 26.6.3