ECHO-1969-c688-a45c
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-1969-c688-a45c.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-1969-c688-a45c
- Upstream
- Withdrawn
- 2026-08-31T14:30:19.360Z
- Published
- 2026-08-30T16:45:31.557Z
- Modified
- 2026-08-31T15:15:03.228224848Z
- Summary
- Keycloak's GHSA advisory (GHSA-rr5q-3xwr-f323) lists the affected range as < 26.6.3 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerability requires a generic parameter-length-limiting mechanism (OIDCProviderConfig's max-length-per-parameter config, TokenEndpoint's checkParameters() gate) that silently drops any oversized request parameter, including subject_token — the fix exempts token-shaped parameters from that drop via a new getTokenParameterNames() method. That length-limiting framework does not exist anywhere in 25.0.6 (same finding as CVE-2026-4634, investigated separately) — confirmed via source search, no getMaxLengthForTheParameter/checkParameters/length-cap mechanism exists on any OIDC grant-type endpoint. With no mechanism to silently drop an oversized subject_token, the described fallback to client-credentials cannot occur.
- Details
- References
Affected packages
Echo / keycloak-25
Package
- Name
- keycloak-25
- Purl
- pkg:deb/echo/keycloak-25
Echo:Maven / org.keycloak:keycloak-server-spi-private
Package
- Name
- org.keycloak:keycloak-server-spi-private
- Purl
- pkg:maven/org.keycloak/keycloak-server-spi-private