Vulnerability · Published Oct 29, 2026 · Assigned by redhat

CVE-2026-117627Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

Medium 5.4

In plain English

A medium-severity missing authorization in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 84.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Single Sign-On 7	see references

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-117627 vdb-entry, x_refsource_REDHAT
RHBZ#2561959 issue-tracking, x_refsource_REDHAT