6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9704

CVE-2026-9704: Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9704

CVE-2026-9704:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.keycloak:keycloak-server-spi-private	maven	< 26.6.3	26.6.3
org.keycloak:keycloak-services	maven	< 26.6.3	26.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by the improper validation of the subject_token parameter in the TokenEndpoint. When an authenticated user with low privileges sends an oversized subject_token, the token is silently dropped, and the system falls back to using the client's credentials. This allows the user to gain the permissions of the client's service account, leading to a privilege escalation.

The patch addresses this vulnerability by introducing a new mechanism to handle "token" parameters. The TokenEndpoint.checkParameters method is modified to differentiate between regular parameters and "token" parameters. It now uses a larger size limit for token parameters and fails the request if the limit is exceeded, instead of silently ignoring the parameter. This prevents the fallback to client credentials and mitigates the privilege escalation vulnerability.

The key changes are in the TokenEndpoint.java file, where the checkParameters method is modified to handle token parameters differently. The OIDCProviderConfig.java file is also modified to introduce new configuration properties for token parameters. Finally, the OAuth2GrantType.java interface and its implementations are modified to identify which parameters are token parameters.

Vulnerable functions

org.keycloak.protocol.oidc.endpoints.TokenEndpoint.checkParameters

services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java

The `checkParameters` function in the `TokenEndpoint` class is responsible for validating the parameters of a token request. Before the patch, this function would silently ignore any parameter that exceeded a certain size limit. In the case of the `subject_token`, this would cause the system to fall back to using the client's credentials, leading to a privilege escalation. The patch modifies this function to fail the request if a token parameter is too long, thus preventing the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.