CVE Alert: CVE-2026-97847 – Red Hat

A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.

**Risk verdict:** High-priority identity-control weakness: prioritise urgently in environments where client managers can configure protocol mappers, but exploitation status is not supplied.

**Why this matters:** Successful abuse could let a limited-privilege operator obtain realm-administrator authority, enabling access to sensitive identity data and changes to users, clients or authentication policy. Realistic goals include persistent access, account takeover and weakening controls for downstream applications. KEV, SSVC, PoC and EPSS indicators were not provided, so current exploitation likelihood cannot be assessed.

**Most likely attack path:** An attacker needs network access and low-level client-management privileges, then must complete a comparatively difficult configuration and token-abuse sequence; no victim interaction is required. The likely route is to alter hardcoded identity claims used by a service-account token and exploit how the identity service resolves its bearer. Scope is unchanged, but administrative access could still affect the wider realm and its relying applications.

**Who is most exposed:** Prioritise internet-accessible or broadly reachable identity deployments where client managers or delegated administrators can edit protocol mappers, especially shared realms serving business applications.

Alert on new or changed hardcoded-claim protocol mappers.

Review service-account token claims for unexpected privileged identities.

Correlate mapper changes with subsequent realm-admin actions.

Investigate unusual token issuance or admin activity by client-management accounts.

Mitigation and prioritisation

Apply the vendor’s fixed update promptly; confirm remediation with the vendor if package status is unclear.

Restrict mapper-management permissions and review existing delegated roles.

Temporarily disable affected service-account clients or mapper changes where operationally safe.

Plan a controlled change, then audit realm roles and service-account configuration for tampering.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.