Description
A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat build of Keycloak 26.4
Default version status: affected
26.4.14-1 to < *unaffected
Red Hat Red Hat build of Keycloak 26.4
Default version status: affected
26.4-22 to < *unaffected
Red Hat Red Hat build of Keycloak 26.4
Default version status: affected
26.4-22 to < *unaffected
Red Hat Red Hat build of Keycloak 26.4.14
Default version status: unaffected
Red Hat Red Hat build of Keycloak 26.6
Default version status: affected
26.6.5-1 to < *unaffected
Red Hat Red Hat build of Keycloak 26.6
Default version status: affected
26.6-11 to < *unaffected
Red Hat Red Hat build of Keycloak 26.6
Default version status: affected
26.6-11 to < *unaffected
Red Hat Red Hat build of Keycloak 26.6.5
Default version status: unaffected
References
- https://access.redhat.com/errata/RHSA-2026:50846 ↗
- https://access.redhat.com/errata/RHSA-2026:50847 ↗
- https://access.redhat.com/errata/RHSA-2026:50848 ↗
- https://access.redhat.com/errata/RHSA-2026:50849 ↗
- https://access.redhat.com/security/cve/CVE-2026-9793 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2482460 ↗