CVE-2026-117627
Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
- State
- Published
- Severity
- 5.4 Medium
- Published
- Oct 29, 2026
- Updated
- Oct 29, 2026
- Reserved
- Oct 27, 2026
Description
A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Red Hat Build of KeycloakRed Hat | |
Red Hat Build of KeycloakRed Hat | |
Red Hat Single Sign-On 7Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-117627vdb-entry
- RHBZ#2561959issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.