CVE-2026-105302 — Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens
A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a request…
Published: 2026-10-05 · CVSS: 5.7 · CVSS 3.1
A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application, potentially leading to unauthorized access to the user's data on external platforms.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7