{"id":"ECHO-1969-c688-a45c","upstream":["CVE-2026-9704","GHSA-rr5q-3xwr-f323"],"severity":[],"modified":"2026-08-31T14:30:19.360Z","affected":[{"package":{"ecosystem":"Echo","name":"keycloak-25"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.6+e2"}]}]},{"package":{"ecosystem":"Echo:Maven","name":"org.keycloak:keycloak-server-spi-private","purl":"pkg:maven/org.keycloak/keycloak-server-spi-private"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]},{"package":{"ecosystem":"Echo:Maven","name":"org.keycloak:keycloak-services","purl":"pkg:maven/org.keycloak/keycloak-services"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-9704"}],"withdrawn":"2026-08-31T14:30:19.360Z","summary":"Keycloak's GHSA advisory (GHSA-rr5q-3xwr-f323) lists the affected\nrange as < 26.6.3 with no lower bound, so by version string alone\n25.0.6 is nominally in range. The actual vulnerability requires a\ngeneric parameter-length-limiting mechanism (OIDCProviderConfig's\nmax-length-per-parameter config, TokenEndpoint's checkParameters()\ngate) that silently drops any oversized request parameter, including\nsubject_token — the fix exempts token-shaped parameters from that\ndrop via a new getTokenParameterNames() method. That length-limiting\nframework does not exist anywhere in 25.0.6 (same finding as\nCVE-2026-4634, investigated separately) — confirmed via source\nsearch, no getMaxLengthForTheParameter/checkParameters/length-cap\nmechanism exists on any OIDC grant-type endpoint. With no mechanism to\nsilently drop an oversized subject_token, the described fallback to\nclient-credentials cannot occur.\n"}