An authenticated user with low-level privileges can use an oversized subject_token JSON Web Token sent to the Keycloak TokenEndpoint. If the JWT exceeds 4000 characters, the server silently drops it and automatically falls back to client credentials. This fallback hands the attacker the full permissions of the client’s service account, allowing privilege escalation.

Red Hat’s Build of Keycloak is affected. The CVE does not list specific product versions, so all deployed instances of this vendor’s Keycloak distribution are potentially impacted until patched.

The vulnerability has a CVSS score of 6.8 and is not listed in the CISA KEV catalog. No public EPSS score is available. Exploitation requires an authenticated session, so an attacker must first gain user access. Once authenticated, the attacker can send a crafted, oversized JWT to the TokenEndpoint and obtain client‑level privileges through the silent token drop, effectively bypassing normal access controls.