CVE-2026-9793
Keycloak JWE Unsigned Claims Processing Bypass
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| keycloak | keycloak | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability allows a remote attacker to submit unauthorized claims during the OIDC authorization process, potentially compromising data integrity.
This means that an attacker could manipulate authorization data, leading to unauthorized access or actions within systems relying on Keycloak for authentication and authorization.
Can you explain this vulnerability to me?
This vulnerability exists in Keycloak and involves the processing of JSON Web Encryption (JWE) encrypted request objects. When such a request is submitted, if the decrypted content is raw JSON, Keycloak may incorrectly process unsigned claims by bypassing the configured signature policy.
As a result, a remote attacker can submit unauthorized claims, which compromises the integrity of data within the OpenID Connect (OIDC) authorization flow.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability violates the signing requirements of the OpenID Connect (OIDC) Core and Financial-grade API (FAPI) standards.
Since these standards are often part of compliance frameworks related to data security and integrity, such as those required by regulations like GDPR and HIPAA, the flaw could negatively impact compliance by undermining the assurance of data integrity and secure authorization flows.
What immediate steps should I take to mitigate this vulnerability?
An immediate mitigating control is to use a redirect URI allowlist, which can help reduce the risk by limiting where requests can be redirected.
However, this is only a compensating control and does not fully address the vulnerability, which violates OIDC Core and Financial-grade API (FAPI) signing requirements.
It is recommended to apply any available patches or updates from the vendor to fix the underlying flaw in Keycloak's processing of JSON Web Encryption (JWE) encrypted request objects.