{"id":"ECHO-1969-c688-a45c","summary":"Keycloak's GHSA advisory (GHSA-rr5q-3xwr-f323) lists the affected\nrange as \u003c 26.6.3 with no lower bound, so by version string alone\n25.0.6 is nominally in range. The actual vulnerability requires a\ngeneric parameter-length-limiting mechanism (OIDCProviderConfig's\nmax-length-per-parameter config, TokenEndpoint's checkParameters()\ngate) that silently drops any oversized request parameter, including\nsubject_token — the fix exempts token-shaped parameters from that\ndrop via a new getTokenParameterNames() method. That length-limiting\nframework does not exist anywhere in 25.0.6 (same finding as\nCVE-2026-4634, investigated separately) — confirmed via source\nsearch, no getMaxLengthForTheParameter/checkParameters/length-cap\nmechanism exists on any OIDC grant-type endpoint. With no mechanism to\nsilently drop an oversized subject_token, the described fallback to\nclient-credentials cannot occur.\n","modified":"2026-08-31T15:15:03.228224848Z","published":"2026-08-30T16:45:31.557Z","withdrawn":"2026-08-31T14:30:19.360Z","upstream":["CVE-2026-9704","GHSA-rr5q-3xwr-f323"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-9704"}],"affected":[{"package":{"name":"keycloak-25","ecosystem":"Echo","purl":"pkg:deb/echo/keycloak-25"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.6+e2"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-1969-c688-a45c.json"}},{"package":{"name":"org.keycloak:keycloak-server-spi-private","ecosystem":"Echo:Maven","purl":"pkg:maven/org.keycloak/keycloak-server-spi-private"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-1969-c688-a45c.json"}},{"package":{"name":"org.keycloak:keycloak-services","ecosystem":"Echo:Maven","purl":"pkg:maven/org.keycloak/keycloak-services"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-1969-c688-a45c.json"}}],"schema_version":"1.9.0"}