Vulnerability in Red Hat Build of Keycloak

[ Description ]Official description

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund27 Oct 2026WID-SEC-2026-4191

  Keycloak: Multiple vulnerabilities Translated from German

  CVE-2026-117627CVE-2026-117688CVE-2026-118030+2 more CVEs

[ References ]References

• access.redhat.com/security/cve/CVE-2026-117627
• bugzilla.redhat.com/show_bug.cgi