Keycloak 26.4.x < 26.4.17 / 26.6.x < 26.6.8 / 26.8.0 < 26.8.2 Token Sanitization Bypass (CVE-2026-97848)

medium Nessus Plugin ID 380313

Synopsis

The remote host is affected by a token sanitization bypass vulnerability.

Description

The version of Keycloak installed on the remote host is 26.4.x prior to 26.4.17, or 26.6.x prior to 26.6.8, 26.8.x prior to 26.8.2. It is, therefore, affected by a vulnerability:

- A flaw was found in the token sanitization logic of Keycloak. The issue occurs when a protocol mapper is configured to emit structured claims using the JSON type. The security check designed to remove unauthorized role mappings only looks for standard Java maps and fails to recognize Jackson based JSON objects. This allows an attacker to inject forged client roles into security tokens, which could lead to unauthorized access to protected resources. (CVE-2026-97848)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade Keycloak to version 26.4.17 / 26.6.8 or later.

Plugin Details

Severity: Medium

ID: 380313

File Name: keycloak_26_4_17.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Misc.

Published: 11/13/2026

Updated: 11/13/2026

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.82

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2026-97848

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Vulnerability Information

CPE: cpe:/a:keycloak:keycloak

Required KB Items: Host/local_checks_enabled, Host/uname, installed_sw/Keycloak

Patch Publication Date: 11/6/2026

Vulnerability Publication Date: 11/5/2026

Reference Information

CVE: CVE-2026-97848

IAVB: 2026-B-0328

Detections

Analytics