A flaw exists in Keycloak's protocol mapper and identity resolution components that allows a client manager to use hardcoded-claim mappers to replace claims in sessionless service‑account tokens. Because these tokens are missing a session ID, Keycloak can incorrectly resolve the token bearer as a different user when the claims are altered, which can elevate the attacker’s rights to those of a realm administrator. The weakness is a form of improper authentication (CWE-287) and can be used to impersonate a highly privileged user and gain complete control over the realm.

Red Hat Build of Keycloak and Red Hat Single Sign‑On 7 are affected. Versions are not specified in the CNA data.

The CVSS score is 7.1, indicating a moderate to high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have client‑management permissions and is therefore likely limited to insiders or compromised client applications. The attack vector is inferred to be through internal configuration changes or malicious client requests, not through an open network-facing interface.