{"id":"CVE-2026-11800","kind":"vulnerability","aliases":["CVE-2026-11800","GHSA-j97h-3f8r-mrjr"],"related":[],"title":"Keycloak has authentication bypass via jwt algorithm confusion","description":"### Description\nA flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.","summary":"Keycloak's JWT Authorization Grant flow accepts forged assertions because signature verification can be bypassed through algorithm confusion. An attacker with valid client credentials can mint access tokens and impersonate federated users linked to an identity provider.","severity":"high","cvss":8.1,"epss":0.003,"exploited":false,"exploited_at":null,"products":[{"name":"org.keycloak:keycloak-services","fixed":["26.6.4"],"affected":"< 26.6.4","ecosystem":"maven"},{"name":"redhat build of keycloak","fixed":["26.6.4"],"affected":">= 26.6, < 26.6.4","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-347","identity","java","keycloak","package","self-hosted","sso"],"not_affected_if":["jwt-grant-unused","keycloak-26.6.4-or-later","managed-hosting"],"how_to_check":"- Check the Keycloak version with the server's version output or the `keycloak-services` artifact version in your build; affected versions are below `26.6.4`.\n- Look for use of the JWT Authorization Grant flow (client authentication with signed assertions) in your realm configuration.","fix":"- Keycloak `keycloak-services`: upgrade to `26.6.4`","status":"open","published_at":"2026-06-25T22:17:00+00:00","first_seen_at":"2026-11-03T17:26:38+00:00","triaged_at":"2026-11-03T17:28:04+00:00","updated_at":"2026-11-03T17:52:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T17:28:04Z","model":"claude-haiku-5-5","output":{"fix":"- Keycloak `keycloak-services`: upgrade to `26.6.4`","reach":"network","title":"Keycloak: JWT algorithm confusion lets attackers forge tokens and impersonate users","impact":"high","summary":"Keycloak's JWT Authorization Grant flow accepts forged assertions because signature verification can be bypassed through algorithm confusion. An attacker with valid client credentials can mint access tokens and impersonate federated users linked to an identity provider.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","identity","sso","java"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker impersonates federated users and obtains unauthorized access tokens","analyst_note":"","how_to_check":"- Check the Keycloak version with the server's version output or the `keycloak-services` artifact version in your build; affected versions are below `26.6.4`.\n- Look for use of the JWT Authorization Grant flow (client authentication with signed assertions) in your realm configuration.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","jwt-grant-unused","keycloak-26.6.4-or-later"],"who_is_affected":"Organizations running self-hosted Keycloak below 26.6.4 that use the JWT Authorization Grant flow with federated identity providers are exposed. An attacker needs valid client credentials first, so deployments without that flow or with no client credentials exposed are at lower risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4307,"output_tokens":571,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-11800':11A,19A '-2026':10A,18A '-347':29B '3f8r':15A 'accept':44B 'access':64B,113C,133C 'affect':127C 'algorithm':7A,54B,84C 'allow':93C 'assert':46B,107C 'attack':57B,95C,109C,118C 'authent':3A 'author':41B,90C 'build':25A 'bypass':4A,52B,101C 'client':60B,98C 'confus':8A,55B,85C 'creat':111C 'credenti':61B,99C 'cve':9A,17A 'cwe':28B 'descript':75C 'enabl':116C 'escal':137C 'feder':68B,122C 'flaw':77C 'flow':43B,92C 'forg':45B,105C 'found':79C 'ghsa':13A 'ghsa-j97h-3f8r-mrjr':12A 'grant':42B,91C 'host':36B 'ident':30B,73B,128C 'imperson':67B,120C 'j97h':14A 'java':31B 'jwt':6A,40B,83C,89C 'keycloak':1A,22A,27A,32B,38B,81C 'keycloak-services':21A 'lead':130C 'link':70B,124C 'mint':63B 'mrjr':16A 'of':26A 'org.keycloak':20A 'packag':33B 'potenti':135C 'privileg':136C 'provid':74B,129C 'redhat':24A 'self':35B 'self-host':34B 'services':23A 'signatur':48B,102C 'sso':37B 'token':65B,114C 'unauthor':112C,132C 'user':69B,123C 'valid':59B,97C 'verif':49B,103C 'via':5A 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted Keycloak below 26.6.4 that use the JWT Authorization Grant flow with federated identity providers are exposed. An attacker needs valid client credentials first, so deployments without that flow or with no client credentials exposed are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["buildofkeycloak","orgkeycloakkeycloakservices","redhatbuildofkeycloak"],"ptokens":["build","keycloak","of","org","redhat","services"],"labels":["cwe347","high","identity","java","keycloak","maven","package","selfhosted","sso","vendor"],"campaign_type":null,"first_public_at":"2026-06-25T22:17:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-j97h-3f8r-mrjr","url":"https://github.com/advisories/GHSA-j97h-3f8r-mrjr","severity":"high","published_at":"2026-11-03T17:24:27+00:00","modified_at":"2026-11-03T17:24:30+00:00","first_seen_at":"2026-11-03T17:26:38+00:00","fetched_at":"2026-11-03T17:31:42+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-11800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11800","severity":null,"published_at":"2026-06-25T22:17:00+00:00","modified_at":"2026-10-25T22:10:00+00:00","first_seen_at":"2026-11-03T17:52:24+00:00","fetched_at":"2026-11-03T17:52:24+00:00","note":null}],"documents":[{"id":59277,"url":"https://api.github.com/repos/keycloak/keycloak/security-advisories/GHSA-j97h-3f8r-mrjr","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":59278,"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-j97h-3f8r-mrjr","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":59279,"url":"https://github.com/keycloak/keycloak/pull/50374","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59280,"url":"https://github.com/keycloak/keycloak/commit/6d61885f20ac59a2ff8b823fc9ed1f1ef1019951","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59281,"url":"https://github.com/keycloak/keycloak/commit/d343c7373dcc7bfeb9dc14de2309836299c81837","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59282,"url":"https://github.com/keycloak/keycloak/releases/tag/26.6.4","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":18035,"url":"https://access.redhat.com/errata/RHSA-2026:30083","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":18036,"url":"https://access.redhat.com/errata/RHSA-2026:30084","title":"Third-party advisory: access.redhat.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":59496,"url":"https://access.redhat.com/security/cve/CVE-2026-11800","title":"Vendor advisory: access.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: access.redhat.com"},{"id":59497,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487006","title":"Vendor advisory: bugzilla.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: bugzilla.redhat.com"},{"id":59498,"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11800.json","title":"Vendor advisory: security.access.redhat.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: security.access.redhat.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}