{"id":"CVE-2026-117627","kind":"vulnerability","aliases":["CVE-2026-117627"],"related":[],"title":"Keycloak: JWT grant flow skips identity provider login restrictions","description":"A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.","summary":"Keycloak's JWT Authorization Grant skips claim filtering and other login restrictions set on OIDC or Google identity providers that browser logins enforce. An authenticated client can obtain access tokens for users whose identity provider claims should have blocked them.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity-provider","keycloak","oidc","package"],"not_affected_if":["jwt-grant-unused","no-identity-provider-restrictions"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-29T07:16:44+00:00","first_seen_at":"2026-10-29T07:23:29+00:00","triaged_at":"2026-10-29T07:23:46+00:00","updated_at":"2026-10-29T07:23:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T07:23:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: JWT grant flow skips identity provider login restrictions","impact":"medium","summary":"Keycloak's JWT Authorization Grant skips claim filtering and other login restrictions set on OIDC or Google identity providers that browser logins enforce. An authenticated client can obtain access tokens for users whose identity provider claims should have blocked them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","oidc","identity-provider"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated client obtains tokens for users who should be blocked","analyst_note":"Find the affected and fixed Keycloak versions and any configuration workaround in the NVD entry or Keycloak's advisory.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-identity-provider-restrictions","jwt-grant-unused"],"who_is_affected":"Organizations running Keycloak with an OIDC or Google identity provider that uses login restrictions such as claim filtering, and that allow JWT Authorization Grant clients. Deployments without such restrictions or without the JWT grant in use are not affected. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":4152,"output_tokens":487,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117627':12A,15A '-2026':11A,14A 'access':50B,120C 'allow':114C 'appli':98C 'authent':46B,116C 'author':25B,68C 'base':110C 'block':60B,133C 'browser':42B,101C 'check':95C 'claim':28B,57B,92C,130C 'client':47B,117C 'compon':76C 'configur':85C 'correct':97C 'cve':10A,13A 'enforc':44B 'even':125C 'filter':29B,93C 'flaw':62C 'flow':4A,112C 'found':64C 'googl':38B,81C 'grant':3A,26B,69C,111C 'ident':6A,17B,39B,55B,82C,128C 'identity-provid':16B 'implement':70C 'jwt':2A,24B,67C,109C 'jwt-base':108C 'keycloak':1A,19B,22B,74C 'keycloak-servic':73C 'login':8A,32B,43B,88C,102C,135C 'obtain':49B,119C 'oidc':20B,36B,79C 'packag':21B 'provid':7A,18B,40B,56B,83C,129C 'restrict':9A,33B,89C 'servic':75C 'set':34B 'skip':5A,27B,105C 'specif':87C 'standard':100C 'token':51B,121C 'user':53B,124C 'whose':54B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Keycloak with an OIDC or Google identity provider that uses login restrictions such as claim filtering, and that allow JWT Authorization Grant clients. Deployments without such restrictions or without the JWT grant in use are not affected. The sources do not name affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T07:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117627","severity":null,"published_at":"2026-10-29T07:16:44+00:00","modified_at":"2026-10-29T07:16:44+00:00","first_seen_at":"2026-10-29T07:23:29+00:00","fetched_at":"2026-10-29T07:23:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}