What is the CVSS score of EUVD-2026-39567?

EUVD-2026-39567 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Keycloak are affected by EUVD-2026-39567?

Keycloak and Red Hat Single Sign-On 7 contain a JWT algorithm-confusion vulnerability (CVE-2026-11800, CVSS 8.1) that enables attackers with valid client credentials to forge authentication tokens…. A patch is available.

How to fix or mitigate EUVD-2026-39567?

Within 24 hours: Audit all Keycloak and Red Hat Single Sign-On 7 deployments; document federated identity providers, connected client applications, and credential holders. Within 7 days: Enforce JWT algorithm whitelisting to block algorithm-confusion attacks; implement enhanced logging for all token creation events; restrict client credential distribution to minimum necessary accounts. Within 30 days: Monitor Red Hat security advisories for patch availability; prepare staging environment and change management process for immediate patching upon vendor release.

Keycloak EUVD-2026-39567

| CVE-2026-11800 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-25 redhat

GHSA-gqj5-2xp5-3qmp

Authentication Bypass Privilege Escalation Jwt Attack Red Hat Build Of Keycloak Red Hat Jboss Enterprise Application Platform Expansion Pack Red Hat Single Sign On 7 Red Hat Data Grid 8 Red Hat Build Of Keycloak 26 6 Red Hat Build Of Keycloak 26 6 4 Red Hat

8.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable, low-complexity flow needing valid client credentials (PR:L); forged tokens enable impersonation giving high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 21:54 vuln.today

DescriptionCVE.org

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.

AnalysisAI

Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Red Hat Build of Keycloak 26.6/26.6.4) lets an attacker holding valid client credentials abuse a JWT algorithm-confusion weakness in the JWT Authorization Grant flow to forge client assertions and mint unauthorized access tokens. The forged tokens allow impersonation of any federated user tied to the affected Identity Provider, yielding unauthorized access and potential privilege escalation. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; Red Hat rates it 8.1 (High).

Technical ContextAI

Keycloak is a widely used open-source identity and access management (IAM) server providing OAuth 2.0/OIDC and SAML based authentication, federation, and single sign-on. The flaw lives in the JWT Bearer / JWT Authorization Grant (RFC 7523) client-authentication flow, where clients authenticate by presenting a signed JWT assertion. The root cause maps to CWE-347 (Improper Verification of Cryptographic Signature): an algorithm-confusion condition where the server does not properly bind the verification key to the expected algorithm, allowing an attacker to substitute a signing algorithm/key under their control (the classic JWT 'alg' confusion pattern, e.g. coercing asymmetric RS* verification into a path the attacker can satisfy). The CPE data confirms the affected footprint spans Red Hat Build of Keycloak 26.6 and 26.6.4, Red Hat Single Sign-On 7, the JBoss EAP Expansion Pack, and Red Hat Data Grid 8 (which ships Keycloak/RH-SSO components).

RemediationAI

Patch available per vendor advisory: apply the fixed packages delivered in Red Hat errata RHSA-2026:30083 (https://access.redhat.com/errata/RHSA-2026:30083) and RHSA-2026:30084 (https://access.redhat.com/errata/RHSA-2026:30084), and consult https://access.redhat.com/security/cve/CVE-2026-11800 and https://bugzilla.redhat.com/show_bug.cgi?id=2487006 for the exact fixed versions for your specific product (Red Hat Build of Keycloak, RH-SSO 7, JBoss EAP Expansion Pack, Data Grid 8); no exact upstream fixed version number was provided in the input, so do not assume one. As compensating controls until patching, if the JWT Authorization Grant / JWT bearer client-authentication flow is not required, disable that grant type on affected clients/realms to remove the attack surface (trade-off: breaks any legitimate service-to-service clients relying on JWT-assertion authentication); tighten which clients are permitted to use the JWT grant and rotate/scope client credentials to shrink the set of actors able to attempt the attack; and increase monitoring of token issuance and federated-login events for anomalous impersonation. Note these mitigations do not fix the underlying signature-verification flaw and should be temporary.