What’s Vulnerable › Vulnerabilities

CVE-2026-117627: Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-29 · updated 2026-10-29
• Weakness: CWE-862

Description

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

Affected products

• Red Hat build of Keycloak 26.4: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-117627
• https://bugzilla.redhat.com/show_bug.cgi?id=2561959

Get alerted when CVE-2026-117627 or the next vulnerability affects your stack