Live › vulnerability › CVE-2026-11800
Keycloak's JWT Authorization Grant flow accepts forged assertions because signature verification can be bypassed through algorithm confusion. An attacker with valid client credentials can mint access tokens and impersonate federated users linked to an identity provider.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:26 UTC, 0h before NVD. All times on this page are UTC.
Organizations running self-hosted Keycloak below 26.6.4 that use the JWT Authorization Grant flow with federated identity providers are exposed. An attacker needs valid client credentials first, so deployments without that flow or with no client credentials exposed are at lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.4 | 26.6.4 |
| redhat build of keycloak | vendor | >= 26.6, < 26.6.4 | 26.6.4 |
keycloak-services artifact version in your build; affected versions are below 26.6.4.keycloak-services: upgrade to 26.6.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.
This page as .md · .json · in your agent: get_signal("CVE-2026-11800")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.