EUVD-2026-44841
GHSA-5xcf-8m2w-ph6f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-facing token endpoint with low complexity; PR:L because a valid external IdP assertion is required; high confidentiality/integrity from unauthorized access, no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.
AnalysisAI
Access-control bypass in Keycloak (fixed in 26.5.3) lets a disabled user account still obtain valid tokens through the JWT authorization grant preview feature. When that feature is enabled, Keycloak omits the account-enabled check during JWT authorization grant processing, so a low-privileged remote attacker who can present a valid assertion token from an external identity provider can mint a JWT for an account an administrator has explicitly disabled, regaining access to protected resources. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the JWT authorization grant (JWT bearer / RFC 7523) preview feature is explicitly enabled in Keycloak - it is disabled by default - and that the attacker can present a valid assertion token signed by an external identity provider that Keycloak trusts, mapping to a target user account that has been disabled by an administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 score is 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - network reachable, low complexity, requiring some existing privilege/authentication material (PR:L), no user interaction, high confidentiality and integrity impact, and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An employee is offboarded and their Keycloak account is disabled, but the JWT authorization grant preview feature is enabled and the attacker still possesses (or can obtain) a valid signed assertion for that account from a trusted external IdP. They present the assertion to Keycloak's JWT authorization grant endpoint, and because the disabled-status check is skipped they receive a fresh access token granting continued access to protected applications and data. … |
| Remediation | Vendor-released patch: Keycloak 26.5.3, which fixes CVE-2026-1609 (issue #46144) along with three sibling security issues (CVE-2026-1529, CVE-2026-1486, CVE-2025-14778) - upgrade to that version or later using the release at https://github.com/keycloak/keycloak/releases/tag/26.5.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Keycloak instances to identify whether JWT authorization grant preview is enabled and review disabled accounts for recent token activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote at
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulne
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), thi
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remote
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to t
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack c
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using
Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowin
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. Rated high severity (CVSS 8.8), th
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
Debian
Bug #1088287| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| open | - | - |
Share
External POC / Exploit Code
Leaving vuln.today