CVE-2026-117627

CVE-2026-117627 · Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

CVSS 5.4 · Medium · EPSS 0.2%

Published: 2026-10-29T06:22:03.427Z
Updated: 2026-10-29T06:22:03.427Z

Affected products and versions

red hat build of keycloak
No fix published
red hat single sign-on 7
No fix published

Original sources

https://access.redhat.com/security/cve/CVE-2026-117627
https://bugzilla.redhat.com/show_bug.cgi?id=2561959
https://nvd.nist.gov/vuln/detail/CVE-2026-117627

Check your server →

CVE-2026-117627 · Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

Affected products and versions

red hat build of keycloak

red hat single sign-on 7

Original sources