CVE-2026-97847

A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.

• CWE-287

• https://access.redhat.com/security/cve/CVE-2026-97847
• https://bugzilla.redhat.com/show_bug.cgi?id=2540950

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97840Out-of-bounds read in DNS Server allows an authorized attack…6.5
• CVE-2026-97841Out-of-bounds read in DNS Server allows an authorized attack…6.5
• CVE-2026-97842Out-of-bounds read in DNS Server allows an authorized attack…6.5
• CVE-2026-97843Out-of-bounds read in DNS Server allows an authorized attack…6.5
• CVE-2026-97844Out-of-bounds read in DNS Server allows an authorized attack…6.5
• CVE-2026-97846Keycloak provides a feature called mTLS holder-of-key bindin…6.8
• CVE-2026-9785Quest NetVault Backup NVBULibrarySlot SQL Injection Remote C…8.8
• CVE-2026-97851The storage status-change REST service allows location recor…9.1
• CVE-2026-97853Memory Allocation with Excessive Size Value vulnerability in…6.9
• CVE-2026-97854Yamaha wireless LAN router NWR100 provided by Yamaha Corpora…9.8
• CVE-2026-97858An attacker can cause the server to unbind the target device…5.3
• CVE-2026-97859Seven Gitea API routes under `/api/v1/users/{username}` (fol…6.5