JWT Algorithm Confusion in Keycloak

Mitigation Strategies

To mitigate the CVE-2026-11800 vulnerability in Keycloak, ensure that the Identity Provider configuration does not have jwtAuthorizationGrantEnabled set to true with a hardcoded public key (useJwksUrl=false) and no pinned assertion signature algorithm. Applying security updates and patches provided by the vendor once available is critical.

Monitor for updates or advisories from Keycloak or Red Hat regarding fixes or configuration changes that address the JWT algorithm confusion vulnerability.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a JWT algorithm confusion flaw found in Keycloak's JWT Authorization Grant flow. It allows an attacker who already has valid client credentials to bypass the signature verification process by forging an assertion. As a result, the attacker can create unauthorized access tokens.

This enables the attacker to impersonate any federated user linked to the affected Identity Provider.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access and potential privilege escalation. An attacker exploiting this flaw can impersonate any federated user, gaining access to resources and data they should not be able to access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to bypass signature verification and impersonate any federated user, leading to unauthorized access and potential privilege escalation.

Such unauthorized access could result in exposure or misuse of sensitive personal or protected health information, which may violate compliance requirements under standards like GDPR and HIPAA.

Therefore, the vulnerability poses a significant risk to maintaining confidentiality and integrity of data, potentially impacting compliance with these regulations.

Useful 0 Not Useful 0

Detection Guidance

To detect the CVE-2026-11800 vulnerability on your system, you should verify if your Keycloak instance is configured with the vulnerable settings. Specifically, check if the Identity Provider has jwtAuthorizationGrantEnabled set to true, uses a hardcoded public key (useJwksUrl=false), and does not have a pinned assertion signature algorithm.

Since the vulnerability involves JWT algorithm confusion in the Authorization Grant flow, monitoring JWT tokens for usage of the HS256 algorithm with the Identity Provider's public key bytes as the HMAC secret can help identify suspicious activity.

There are no explicit commands provided in the resources to detect this vulnerability, but you can use the following general approaches:

• Inspect Keycloak configuration files or API responses to confirm the value of jwtAuthorizationGrantEnabled and useJwksUrl settings.
• Use JWT decoding tools or scripts to analyze tokens issued by Keycloak and check if tokens are signed with HS256 using the public key as the secret.
• Monitor logs for unusual token issuance patterns or authentication bypass attempts.

Example commands might include:

• Using curl or similar tools to query Keycloak's Identity Provider configuration endpoints to check relevant settings.
• Using jwt-cli or jwt.io tools to decode and inspect JWT tokens.

Useful 0 Not Useful 0