BIT-keycloak-2026-11800

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-11800.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-keycloak-2026-11800
Aliases
  • CVE-2026-11800
Published
2026-08-25T11:41:31Z
Modified
2026-09-08T08:48:06Z
Summary
Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion
Details

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / keycloak

Package

Name
keycloak
Purl
pkg:bitnami/keycloak

Severity

  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
26.6.0
Fixed
26.6.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-11800.json"