CVE-2026-105302

Executive Summary

CVE-2026-105302 is an information disclosure flaw (CWE-200) in the User Session Note mapper of the Keycloak identity and access management solution. The mapper fails to validate whether a requested session note contains sensitive internal credentials — specifically federated access tokens from external identity providers — allowing a delegated client administrator to leak a user's upstream bearer tokens into tokens issued to their managed application. A successful exploit can result in unauthorized access to the affected user's data on external platforms, although exploitation requires user interaction and the attacker must already hold a privileged administrative position.

Technical Analysis

Keycloak employs a protocol mapper architecture in which pieces of user session state — referred to as session notes — can be projected into tokens (such as access and ID tokens) that Keycloak issues to client applications. A "User Session Note" mapper is intended to expose a named session note value to a downstream application through a token claim.

The vulnerability resides in the validation logic (or lack thereof) of that mapper. Per the NVD description, the mapper "does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers." Federated identity flows (for example, brokering to an upstream OIDC or OAuth identity provider) store the upstream access/refresh token in the Keycloak user session so that the broker can subsequently call the external provider's APIs on behalf of the user. Session notes are an internal storage mechanism and are not inherently scoped for release into client-visible tokens.

Because the User Session Note mapper exposes an arbitrary named session note as a token claim without checking whether that note is restricted, a delegated client administrator — a principal granted administrative rights over their own client within a realm — can configure a mapper that names the session note holding the federated token and thereby cause the user's upstream bearer token to be embedded in the tokens Keycloak issues to the managed application. The client administrator can then read that claim directly from the token, extracting a credential that is valid against the external identity provider.

This is an authorization/validation boundary failure in the mapper, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It is not a remote code execution issue; the core impact is credential exposure that enables lateral movement into third-party platforms.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) confirms: network-reachable, low attack complexity, but the attacker requires low privileges (an authenticated, delegated administrator) and some user interaction (a user must authenticate through the affected flow so a session with an upstream token exists). Confidentiality impact is High; integrity and availability impacts are None, and the scope is unchanged.

No affected version range, patch, or workaround data is available in the provided intelligence. The specific session note name, mapper parameter names, and internal Keycloak version are not disclosed in the available data; the analysis above is confined to the vulnerability class and the mechanism described in the NVD entry.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (improper credential-scope validation in a session-note-to-token mapper).

1. Reconnaissance / target identification. The attacker identifies a Keycloak realm that performs identity brokering to an external identity provider, and where the attacker has been granted delegated administrative rights over a client application (the "managed application").

2. Trigger condition. The flaw is exercised only when a user authenticates through the brokered flow, so that Keycloak stores the upstream federated access token in the user's session. This corresponds to the UI:R (user interaction) component of the CVSS vector — an administrator cannot complete the attack without a user session carrying the upstream token.

3. Configuration / payload method. Using their delegated client-administrator role, the attacker configures a User Session Note mapper on their managed client, naming the session note that holds the upstream federated access token. Because the mapper does not validate whether the requested session note contains sensitive internal credentials, the upstream bearer token is copied into the tokens Keycloak issues to the managed application rather than being blocked or stripped.

4. Extraction. Once a user authenticates, the attacker (or the managed application) reads the issued token and extracts the leaked upstream bearer token from the injected claim.

5. Post-exploitation impact. The extracted bearer token is a valid credential for the external identity provider, so the attacker can use it to access the affected user's data on external platforms — unauthorized access beyond the boundaries of the Keycloak realm, as described in the NVD entry.

Note: The exact session note key name and mapper configuration field names are not disclosed in the available data and are intentionally not fabricated here.

Impact Assessment

• Confidentiality: High (C:H). Successful exploitation leaks upstream federated bearer tokens — live credentials with real authority over third-party data.
• Integrity: None (I:N). The flaw does not by itself allow modification of data within Keycloak or the managed application.
• Availability: None (A:N). No denial-of-service component.
• Attack Vector: Network (AV:N); Complexity: Low (AC:L). A remote actor with valid administrative access can perform the configuration without advanced tradecraft.
• Privileges Required: Low (PR:L). The attacker must be a delegated client administrator — a meaningful precondition that limits the pool of abusers to insiders, compromised admin accounts, or over-privileged delegated roles.
• User Interaction: Required (UI:R). Exploitation depends on a user completing an authentication flow so that a session note containing an upstream token exists.
• Scope: Unchanged (S:U). Keycloak itself does not gain new authority, but the leaked token grants the attacker access to external systems, extending business impact well past the IAM platform.
• CVSS base: 5.7 (Medium). The High confidentiality subscore is substantially mitigated by the privileged and interactive preconditions.
• Blast radius. Any Keycloak deployment that brokers to external identity providers and grants delegated client administration to non-fully-trusted principals. Impact propagates downstream to every external platform for which brokered tokens are collected — making third-party SaaS and API ecosystems the true exposure surface.

Detection Guidance

Sigma Rule

title: Keycloak User Session Note Mapper Configured to Expose Federated Tokens
id: 7c1f9d2a-4b6e-4a3f-9c21-cve2026105302
status: experimental
description: Detects creation or update of a Keycloak client protocol mapper of type "User Session Note" that may expose sensitive session notes such as federated access tokens (CVE-2026-105302).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105302
author: valtersit.com
date: 2026/01/01
logsource:
  product: keycloak
  service: admin-events
detection:
  selection_action:
    operation|contains:
      - 'CREATE'
      - 'UPDATE'
  selection_resource:
    resourceType: 'CLIENT'
  selection_mapper:
    representation|contains: 'User Session Note'
  condition: selection_action and selection_resource and selection_mapper
fields:
  - clientId
  - resourcePath
  - representation
level: medium
tags:
  - attack.t1078
  - attack.credential_access

YARA Rule

rule CVE_2026_105302_Keycloak_SessionNote_Mapper
{
    meta:
        description = "Detects Keycloak configuration/log artifacts referencing User Session Note mappers that could expose federated tokens (CVE-2026-105302)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105302"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $mapper = "User Session Note" ascii wide nocase
        $federated = "federated" ascii wide nocase
        $token = "access_token" ascii wide nocase
        $kc = "keycloak" ascii wide nocase
        $mappertype = "usernote" ascii wide nocase
    condition:
        filesize < 5MB and
        (uint16(0) == 0x7B0D or uint16(0) == 0x7B7B or true) and
        $mapper and $kc and ($federated or $token or $mappertype)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105302 Keycloak User Session Note Mapper Configuration Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/admin/realms/"; content:"/clients/"; content:"/protocol-mappers/models"; http.request_body; content:"User Session Note"; nocase; reference:cve,2026-105302; classtype:attempted-info-leak; sid:2026105302; rev:1;)

Elastic Detection

event.category:"authentication" or event.category:"iam"
| where event.action in ("create", "update")
| where process.name like~ "keycloak*" or service.name == "keycloak"
| where message like~ "*User Session Note*" and message like~ "*CLIENT*"

Splunk SPL Query

index=keycloak sourcetype=keycloak:admin
| search operation IN ("CREATE","UPDATE") resourceType="CLIENT" "User Session Note"
| stats count values(representation) as mapper_config values(resourcePath) as path by clientId, authDetails.username, src_ip
| where count > 0
| table _time, authDetails.username, src_ip, clientId, path, mapper_config

Wazuh OSSEC Rule

<group name="keycloak,keycloak_admin">
  <rule id="105302" level="10">
    <decoded_as>json</decoded_as>
    <field name="operation">CREATE|UPDATE</field>
    <field name="resourceType">CLIENT</field>
    <match>User Session Note</match>
    <description>CVE-2026-105302: Keycloak User Session Note mapper created or updated - possible federated token exposure</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>credential_access,pci_dss_10.2.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data is available from tracked sources. The following measures are class-level hardening steps for a validation-boundary information disclosure of this type; none are confirmed vendor remediations.

1. Immediate mitigations
   • Restrict the ability to create or edit client protocol mappers. Review all delegated client-administrator assignments and revoke them where not strictly required.
   • Audit existing User Session Note mappers across all clients and remove any that reference session notes associated with brokered/federated tokens.
   • Where a mapper cannot be removed, verify that its targeted note does not resolve to an upstream identity-provider token.
   • Limit identity brokering to trusted upstream providers, and monit