Log in Start free

Vulnerability · Published Jul 16, 2026 · Assigned by redhat

CVE-2026-1609Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

High 8.1

In plain English

A high-severity improper access control in Keycloak from Keycloak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 53.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.

Affected products (as reported)

VendorProductVersions
Keycloak Keycloak 26.5.0 – before 26.5.3
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform 8 see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack see references

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References