Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

CVE	CVE-2026-11800
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-06-25 22:17:00 UTC
Updated	2026-07-01 18:35:29 UTC
Description	A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.

Primary CVSS: v3.1 8.1 HIGH from ADP

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.001810000 probability, percentile 0.078190000 (date 2026-07-04)

Problem Types: CWE-347 | CWE-347 Improper Verification of Cryptographic Signature

Version	Source	Type	Score	Severity	Vector
3.1	ADP	CVSS	8.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`
3.1	[email protected]	Secondary	8.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	8.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`
3.1	CNA	CVSS	8.1	HIGH	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Type	Vendor	Product	Version	Update	Edition	Language
Application	Redhat	Build Of Keycloak	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Red Hat	Red Hat Build Of Keycloak 26.6	unaffected 26.6.4-2 * rpm	Not specified
CNA	Red Hat	Red Hat Build Of Keycloak 26.6	unaffected 26.6-8 * rpm	Not specified
CNA	Red Hat	Red Hat Build Of Keycloak 26.6	unaffected 26.6-8 * rpm	Not specified
CNA	Red Hat	Red Hat Build Of Keycloak 26.6.4	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Keycloak	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Keycloak	Not specified	Not specified
CNA	Red Hat	Red Hat Data Grid 8	Not specified	Not specified
CNA	Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	Not specified	Not specified
CNA	Red Hat	Red Hat Single Sign-On 7	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Keycloak 26.6	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Keycloak 26.6.4	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Keycloak	Not specified	Not specified
ADP	Red Hat	Red Hat Data Grid 8	Not specified	Not specified
ADP	Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	Not specified	Not specified
ADP	Red Hat	Red Hat Single Sign-On 7	Not specified	Not specified

Reference	Source	Link	Tags
access.redhat.com/errata/RHSA-2026:30084	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com	Vendor Advisory
access.redhat.com/errata/RHSA-2026:30083	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com	Vendor Advisory
access.redhat.com/security/cve/CVE-2026-11800	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com	Vendor Advisory
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11800.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com	Vendor Advisory
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

CNA: Red Hat would like to thank Bilal Teke for reporting this issue. (en)

ADP: RHSA-2026:30084: Red Hat build of Keycloak 26.6

ADP: RHSA-2026:30083: Red Hat build of Keycloak 26.6.4

There are currently no legacy QID mappings associated with this CVE.