Vulnerabilities

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component.

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Red Hat

Product

Red Hat Build of Keycloak, Red Hat Single Sign-On 7

CVSS v3.1

5.4 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness

CWE-862

Exposure class

Identity, Web platform

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-117627 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 17
   CVE NVD 3d ago

   A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component.

   CVSS 5.4 CVE-2026-117859 Red Hat