EUVD-2026-65465
GHSA-9f9p-c2v5-98rx
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Network token endpoint requires low-privilege client credentials plus a trusted IdP assertion raising complexity to High; no availability impact; confidentiality High for unauthorized user token acquisition.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.
AnalysisAI
Consent bypass in Red Hat Build of Keycloak's keycloak-services component allows an authenticated attacker holding valid client credentials and a trusted identity provider assertion to obtain OAuth2 access tokens for user accounts at consent-gated clients without the user's knowledge or approval. The JWT Bearer authorization grant flow (RFC 7523) omits the consent validation step that is correctly enforced in other grant types - classified as CWE-862 (Missing Authorization). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three simultaneous conditions: (1) the attacker must hold valid OAuth2 client credentials for a client registered in the target Keycloak realm - this is a low-privilege authenticated requirement (PR:L per CVSS); (2) the attacker must possess or be able to obtain a JWT assertion issued by an identity provider configured as trusted within the realm - this is the primary high-complexity factor (AC:H) driving the CVSS score; and (3) the targeted client must have a consent requirement configured, as the flaw specifically bypasses that gate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.9 Medium score reflects a meaningful but constrained attack surface: AV:N confirms network reachability via the token endpoint, but AC:H imposes a significant compound prerequisite - the attacker must simultaneously hold valid OAuth2 client credentials (PR:L) and be able to produce or obtain a JWT assertion from an identity provider configured as trusted in the target realm. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained valid OAuth2 client credentials - through credential theft, a compromised service account, or insider access - and can obtain a JWT assertion from any identity provider trusted by the target Keycloak realm constructs a JWT Bearer grant request targeting a consent-gated client. The keycloak-services token endpoint processes the request, skips the consent validation step, and returns an access token scoped to the target user without their knowledge. … |
| Remediation | Monitor https://access.redhat.com/security/cve/CVE-2026-79652 and https://bugzilla.redhat.com/show_bug.cgi?id=2523347 for a confirmed patched release from Red Hat; no exact fix version was available in the provided data, so patch availability should be verified directly against the vendor advisory before acting on version-specific guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today