What is the CVSS score of CVE-2026-9793?

CVE-2026-9793 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Red Hat Keycloak are affected by CVE-2026-9793?

Red Hat Build of Keycloak contains a vulnerability allowing attackers without valid credentials to forge authentication claims and bypass authorization controls.

How to fix or mitigate CVE-2026-9793?

Within 24 hours: create an inventory of all Keycloak deployments and document versions in use; review recent authentication and authorization logs for anomalous activity or unexpected privilege grants. Within 7 days: enforce strict redirect URI allowlists across all Keycloak instances; review OIDC signature verification policies to ensure strict enforcement; disable JWE-encrypted request object support if not operationally required by your applications. Within 30 days: establish continuous monitoring and alerting for suspicious OIDC claim patterns; engage Red Hat support to obtain patch timeline and additional configuration hardening recommendations; review and update incident response procedures for authentication compromise scenarios.

Red Hat Keycloak CVE-2026-9793

EUVD-2026-32707 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-05-28 redhat

GHSA-p3v8-fm5p-v84h

Authentication Bypass Jwt Attack Red Hat Build Of Keycloak Red Hat

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable OIDC endpoint, no authentication required to submit request object; integrity impact only, no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 05, 2026 - 17:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 05, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Aug 05, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

Aug 05, 2026 - 17:22 NVD

5.9 (MEDIUM) 7.5 (HIGH)

Analysis Generated

May 28, 2026 - 05:03 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

52 maven packages depend on org.keycloak:keycloak-services (20 direct, 32 indirect)

Ecosystem-wide dependent count for version 26.6.4.

DescriptionNVD

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.

AnalysisAI

Signature verification bypass in Red Hat Build of Keycloak exposes OIDC authorization flows to unauthorized claim injection via JWE-encrypted request objects. When a JWE-encrypted request object is submitted and its decrypted payload is raw JSON rather than a signed JWT, Keycloak processes the claims without enforcing the configured signature policy, violating both OIDC Core and Financial-grade API (FAPI) signing requirements. An unauthenticated remote attacker can exploit this to submit forged claims into the authorization flow, achieving high integrity impact against affected deployments; no public exploit has been identified at time of analysis, and a redirect URI allowlist serves as a partial compensating control.

Technical ContextAI

CWE-347 (Improper Verification of Cryptographic Signature) is the root cause: the code path that handles JWE-decrypted content does not enforce that the inner payload must itself be a signed JWT (JWS) before processing its claims. JSON Web Encryption (JWE) provides confidentiality via asymmetric or symmetric key encryption but does not guarantee authenticity or integrity of the plaintext - that role belongs to the inner JWS signature. The affected product is identified via CPE cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*, covering all tracked versions of the Red Hat-supported Keycloak distribution. In FAPI-compliant deployments, signed and encrypted request objects are a core security requirement, making this bypass particularly damaging in regulated sectors such as open banking.

RemediationAI

Apply the Red Hat-issued errata patches: RHSA-2026:50846 (https://access.redhat.com/errata/RHSA-2026:50846), RHSA-2026:50847, RHSA-2026:50848, and RHSA-2026:50849, available through the Red Hat Customer Portal at https://access.redhat.com/security/cve/CVE-2026-9793. Exact fixed version numbers are not independently confirmed from the available input data - consult the errata pages directly for specific package versions. As a compensating control prior to patching, enforce a strict redirect URI allowlist on all OIDC clients, which the CVE description identifies as a partial mitigation that limits the scope of unauthorized claim injection. Additionally, disable or restrict JWE-encrypted request object acceptance on OIDC clients that do not require this feature, specifically via Keycloak client advanced settings; this eliminates the attack surface entirely for those clients, with the trade-off that any clients requiring encrypted request objects (e.g., FAPI-compliant clients) cannot use this workaround. For community Keycloak deployments, monitor the upstream Keycloak project for a corresponding fix.