Bug 2561959 (CVE-2026-117627)

Summary: CVE-2026-117627 keycloak-services: keycloak-services: JWT Authorization Grant bypasses Identity Provider login restrictions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-27 13:17:02 UTC 
A vulnerability was found in Keycloak where the JWT Authorization Grant (RFC 7523) fails to enforce login restrictions configured on OIDC or Google identity providers. Specifically, restrictions such as Filtered by claims or Hosted Domain are bypassed when the grant is processed. An authenticated confidential client with the JWT Authorization Grant enabled can submit a signed assertion for an existing federated user and receive realm tokens, even if the assertion contains claims that violate the identity provider's security policies. An attacker with client credentials and a validly signed assertion can bypass intended access controls to obtain unauthorized realm access for federated users.