HIGH🇵🇱 Wersja polska

CVE-2026-1609

CVSS 8.1v3.1pub. 2026-07-16upd. 2026-08-09

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

  • Red Hat Build Of Keycloak

    APP
    Redhat
    26.5.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-16442HIGH7.4PL ✓same product

Keycloak SAML Broker: pominięcie ograniczeń logowania w IdP-initiated SSO

CVE-2026-15572HIGH8.8PL ✓same product

Keycloak DCR: obejście polityki mapperów i eskalacja do admina

CVE-2026-16102HIGH8.1PL ✓same product

Keycloak DCR: fałszowanie ról administracyjnych przez User Property mapper

CVE-2026-15573HIGH8.1PL ✓same product

Keycloak: ominięcie polityki bezpieczeństwa przez nieprawidłową normalizację URI

CVE-2026-16443HIGH7.4PL ✓same product

Pominięcie weryfikacji podpisu SAML w Red Hat Build of Keycloak