Keycloak CVE-2026-11800

Requires the attacker to already possess valid client credentials for the Keycloak/RH-SSO deployment (CVSS PR:L) and requires that the JWT Authorization Grant (JWT bearer assertion) client-authentication flow be in use with at least one Identity Provider configured for federated users - that federation linkage is what the impersonation targets. The attack is remote and network-reachable (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N). Limiting factors that reduce real-world risk: it is NOT unauthenticated - without valid client credentials the forged-assertion path cannot be initiated; and deployments that do not enable the JWT Authorization Grant flow or do not link federated identities are not exposed via this vector.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) describes a network-reachable, low-complexity attack requiring some privileges (PR:L - valid client credentials) and no user interaction, with high confidentiality and integrity impact and no availability impact. The PR:L requirement is the key limiting factor: the attacker must already possess legitimate client credentials, so this is not a fully anonymous internet-wide exploit, which materially reduces the realistic attacker pool versus a PR:N flaw. No EPSS score and no SSVC decision data were provided in the input, so automatability and exploitation-likelihood scoring cannot be quantified here. It is not listed in CISA KEV and no POC was supplied. Net assessment: a genuinely serious authentication-bypass/impersonation bug in a high-value IAM component - worth prioritized patching wherever Keycloak/RH-SSO mediates federated access - but the credentialed precondition and absence of known exploitation place it below drop-everything emergency status. Note: identity-impersonation of 'any federated user' arguably crosses a security authority boundary (a case could be made for scope-changed S:C), yet Red Hat scored S:U; the difference does not change the High rating.

An attacker who has obtained valid client credentials for a Keycloak/RH-SSO client crafts a JWT client assertion that exploits the algorithm-confusion weakness so that Keycloak accepts a forged signature in the JWT Authorization Grant flow. Using that forged assertion, the attacker obtains access tokens that impersonate arbitrary federated users linked to the Identity Provider, then uses those tokens to reach downstream applications as the victim. No public exploit was identified at time of analysis, and the attack is network-based and low-complexity once valid client credentials are held.