Live › vulnerability › CVE-2026-117627
Keycloak's JWT Authorization Grant skips claim filtering and other login restrictions set on OIDC or Google identity providers that browser logins enforce. An authenticated client can obtain access tokens for users whose identity provider claims should have blocked them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 07:23 UTC. All times on this page are UTC.
Organizations running Keycloak with an OIDC or Google identity provider that uses login restrictions such as claim filtering, and that allow JWT Authorization Grant clients. Deployments without such restrictions or without the JWT grant in use are not affected. The sources do not name affected versions.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.
This page as .md · .json · in your agent: get_signal("CVE-2026-117627")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.