Keycloak Client Policy Bypass via Unsigned JWT Assertion

Executive Summary

This vulnerability in Keycloak allows attackers to bypass security policies requiring signed JWTs for client authentication. By providing a fake unsigned assertion header with a valid algorithm field, the system incorrectly assumes the policy requirements are met. This lets attackers authenticate using weaker methods like client secrets even when stronger signed assertions are mandated.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak logs for authentication attempts using unsigned JWTs when signed assertions are enforced. Check for requests with valid alg fields but missing proper assertion headers. Review client authentication logs for anomalies where clients bypass policy requirements.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid client credentials could exploit this to authenticate without proper signed assertions, potentially gaining unauthorized access to resources or performing actions they shouldn't. This undermines enforced security policies and could lead to data breaches or privilege escalation if the attacker gains elevated access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication methods like signed JWTs. Organizations relying on Keycloak's client policies for regulatory compliance may fail audits if this flaw allows weaker authentication methods to bypass mandated security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Keycloak patches immediately. Review and update Client Policies to enforce strict signed JWT validation. Disable unsigned assertion headers in configurations. Monitor for unauthorized authentication attempts and restrict client credentials to trusted methods.

Useful 0 Not Useful 0