---
id: "CVE-2026-117627"
kind: "vulnerability"
aliases: ["CVE-2026-117627"]
title: "Keycloak: JWT grant flow skips identity provider login restrictions"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["identity-provider", "keycloak", "oidc", "package"]
not_affected_if: ["jwt-grant-unused", "no-identity-provider-restrictions"]
published_at: "2026-10-29T07:16:44+00:00"
first_seen_at: "2026-10-29T07:23:29+00:00"
updated_at: "2026-10-29T07:23:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117627", "first_seen_at": "2026-10-29T07:23:29+00:00"}]
---

# Keycloak: JWT grant flow skips identity provider login restrictions

Keycloak's JWT Authorization Grant skips claim filtering and other login restrictions set on OIDC or Google identity providers that browser logins enforce. An authenticated client can obtain access tokens for users whose identity provider claims should have blocked them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-29T07:23:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117627

## From the sources

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_