What is the CVSS score of CVE-2026-1609?

CVE-2026-1609 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Keycloak are affected by CVE-2026-1609?

Keycloak deployments with JWT authorization grant preview feature enabled are vulnerable to access-control bypass allowing disabled user accounts to retain active token access to protected resources.. A patch is available.

How to fix or mitigate CVE-2026-1609?

Within 24 hours, audit all Keycloak instances to identify whether JWT authorization grant preview is enabled and review disabled accounts for recent token activity. Within 7 days, either disable the JWT preview feature operationally or begin staged upgrade testing of Keycloak 26.5.3 in pre-production environments. Complete upgrade to Keycloak version 26.5.3 in all production systems within 30 days and restore the JWT feature with added monitoring for disabled account token requests.

Keycloak CVE-2026-1609

EUVD-2026-44841 HIGH

Improper Access Control (CWE-284)

2026-07-16 redhat

GHSA-5xcf-8m2w-ph6f

Authentication Bypass Keycloak Red Hat Jboss Enterprise Application Platform 8 Red Hat Jboss Enterprise Application Platform Expansion Pack

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (redhat) PRIMARY

HIGH

qualitative

NVD

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-facing token endpoint with low complexity; PR:L because a valid external IdP assertion is required; high confidentiality/integrity from unauthorized access, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 02:02 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 01:14 vuln.today

Analysis Generated

Jul 16, 2026 - 01:14 vuln.today

CVE Published

Jul 16, 2026 - 00:26 cve.org

HIGH 8.1

DescriptionNVD

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.

AnalysisAI

Access-control bypass in Keycloak (fixed in 26.5.3) lets a disabled user account still obtain valid tokens through the JWT authorization grant preview feature. When that feature is enabled, Keycloak omits the account-enabled check during JWT authorization grant processing, so a low-privileged remote attacker who can present a valid assertion token from an external identity provider can mint a JWT for an account an administrator has explicitly disabled, regaining access to protected resources. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Keycloak is a widely deployed open-source identity and access management server, also shipped inside the Red Hat build of Keycloak/RH-SSO and Red Hat JBoss EAP via the EAP Expansion Pack. The affected component is the JWT Bearer / JWT authorization grant flow (RFC 7523), a preview feature in which a client presents a signed assertion issued by a trusted external identity provider and exchanges it for a Keycloak-issued access token. The root cause is CWE-284 (Improper Access Control): during this token-exchange path Keycloak validates the incoming assertion but fails to re-check the resolved local user's 'enabled' flag before issuing tokens, so the account-disabled gate that protects normal login flows is skipped. It is closely related to two sibling issues fixed in the same release - CVE-2026-1486 (disabled identity providers bypassed in the same JWT grant) and CVE-2026-1529 - indicating a systemic gap in validation coverage across the JWT authorization grant code path.

RemediationAI

Vendor-released patch: Keycloak 26.5.3, which fixes CVE-2026-1609 (issue #46144) along with three sibling security issues (CVE-2026-1529, CVE-2026-1486, CVE-2025-14778) - upgrade to that version or later using the release at https://github.com/keycloak/keycloak/releases/tag/26.5.3. For Red Hat JBoss EAP 8 and the EAP Expansion Pack / Red Hat build of Keycloak deployments, apply the corresponding downstream update tracked at https://access.redhat.com/security/cve/CVE-2026-1609 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2435257. If immediate patching is not possible, the most direct compensating control is to disable the JWT authorization grant preview feature, since the vulnerable code path only executes when it is enabled - this fully removes exposure at the cost of losing that RFC 7523 token-exchange capability. Alternatively, restrict or revoke trust in the external identity providers whose assertions feed the grant, and tighten offboarding so accounts are fully removed rather than only disabled, accepting that the latter is only a partial mitigation.