CVE-2026-117627— Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

Quick assessment

Affected

Red Hat Red Hat Build of Keycloak

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 keycloak-services 组件的 JWT 授权（Authorization Grant）实现中发现了一个缺陷。当配置了 OIDC 或 Google 身份提供者并启用了特定的登录限制（例如声明过滤）时，这些检查在标准的浏览器登录流程中能够正确执行，但在基于 JWT 的授权流程中却被跳过。这导致已认证的客户端能够获取用户的访问令牌，即使该用户的身份提供者声明本应阻止其登录。

CVSS 5.4 · Medium Updated Oct 29, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1086 T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Build of Keycloak	-	`cpe:/a:redhat:build_keycloak:`
Red Hat	Red Hat Build of Keycloak	-	`cpe:/a:redhat:build_keycloak:`
Red Hat	Red Hat Single Sign-On 7	-	`cpe:/a:redhat:red_hat_single_sign_on:7`

II. Public POCs for CVE-2026-117627

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117627

请登录查看更多情报信息。

Other References for CVE-2026-117627 (2)

https://access.redhat.com/security/cve/CVE-2026-117627 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2561959 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-117627

Same Patch Batch · Red Hat · 2026-10-29 · 8 CVEs total

CVE-2026-114488	7.4 HIGH	Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocation
CVE-2026-15564	7.4 HIGH	Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
CVE-2026-117548	6.5 MEDIUM	389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schem
CVE-2026-19610	6.5 MEDIUM	Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for p
CVE-2026-117859	5.4 MEDIUM	Keycloak-services: keycloak-services: par single-use bypass via flow restart
CVE-2026-117688	5.3 MEDIUM	Keycloak-services: keycloak-services: vault secret disclosure via client registration inst
CVE-2026-118030	4.2 MEDIUM	Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse acr

IV. Related Vulnerabilities

Same product: Red Hat Build of Keycloak

Same vendor: Red Hat

Same weakness: CWE-862