CVE-2026-9704

Vendor solution

To prevent the silent dropping of oversized `subject_token` JWTs, configure Keycloak to enforce strict parameter validation. This involves setting the `fail-fast` parameter to `true` for the `TokenEndpoint` configuration, which will cause requests with oversized parameters to be rejected explicitly rather than silently processed with reduced privileges. Consult Keycloak documentation for the exact method to modify these settings. A restart of the Keycloak service may be necessary for the changes to apply.

Red Hat statement

This Moderate flaw in Keycloak allows an authenticated, low-privileged user to escalate privileges. By submitting an oversized `subject_token` JWT to the TokenEndpoint, the system defaults to client credentials, granting the attacker the client's service account permissions. This bypass occurs when the token exceeds a 4000-character limit, leading to an unintended privilege gain.

Red Hat mitigation

To prevent the silent dropping of oversized `subject_token` JWTs, configure Keycloak to enforce strict parameter validation. This involves setting the `fail-fast` parameter to `true` for the `TokenEndpoint` configuration, which will cause requests with oversized parameters to be rejected explicitly rather than silently processed with reduced privileges. Consult Keycloak documentation for the exact method to modify these settings. A restart of the Keycloak service may be necessary for the changes to apply.