CVE-2026-79652— Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired
Quick assessment
Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
发现了一个漏洞，涉及 Red Hat Build of Keycloak 的 keycloak-services 组件中的 JWT 持有者授权实现。该组件处理各种 OAuth2 和 OpenID Connect 授权类型，用于签发访问令牌。问题在于，JWT 持有者授权在签发令牌之前未检查客户端是否需要用户同意。这导致拥有有效客户端凭据和受信任的身份提供者断言的认证攻击者能够绕过同意要求，并在需要用户同意的客户端上未经授权使用用户账户。
Possible ATT&CK Techniques 2 AI
T1133 · External Remote Services T1528 · Steal Application Access TokenAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | any |
affected |
any |
affected | ||
any |
affected | ||
| Red Hat | Red Hat Single Sign-On 7 | any |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79652
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 | - |
cpe:/a:redhat:red_hat_single_sign_on:7
|
|
II. Public POCs for CVE-2026-79652
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79652
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-79652 (2)
Same Patch Batch · Red Hat · 2026-08-25 · 10 CVEs total
| CVE-2026-79992 | 7.8 HIGH | Emacs: local shell command injection through the user field in emacs tramp |
| CVE-2026-79655 | 7.8 HIGH | Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targ |
| CVE-2026-80186 | 7.6 HIGH | Bluez: stack overflow in name2utf8 causes dos and potential code execution |
| CVE-2026-78701 | 6.5 MEDIUM | 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall d |
| CVE-2026-78322 | 6.5 MEDIUM | File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar hand |
| CVE-2026-79717 | 6.4 MEDIUM | Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrict |
| CVE-2026-80185 | 5.7 MEDIUM | Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary cod |
| CVE-2026-77680 | 5.3 MEDIUM | Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025 |
| CVE-2026-80101 | 4.4 MEDIUM | Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-l |
IV. Related Vulnerabilities
Same product: Red Hat Build of Keycloak
-
CVE-2026-19608
Keycloak-services: keycloak-services: name-only group claims -
CVE-2026-18967
Keycloak-services: keycloak-services: saml onetimeuse assert -
CVE-2026-18569
Keycloak-services: keycloak-services: oidc backchannel logou -
CVE-2026-18573
Keycloak-services: keycloak-services: client access-type pol -
CVE-2026-18572
Keycloak-services: keycloak-services: uma claim token can ov
Same vendor: Red Hat
-
CVE-2026-79654
Ketello: katello content view history api cross-organization -
CVE-2026-80185
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent- -
CVE-2026-80186
Bluez: stack overflow in name2utf8 causes dos and potential -
CVE-2026-80101
Gimp: multiple heap out-of-bounds reads in xwd loader from u -
CVE-2026-77680
Libsoup3: libsoup: quadratic cpu denial of service in http r
Same weakness: CWE-862
-
CVE-2026-19197
Broken access control in dashboard snapshots -
CVE-2026-18431
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated R -
CVE-2026-80193
Kimai before 2.62.0 Authorization Bypass via QuickEntry -
CVE-2026-80191
GROWI before 8.0.2 Missing Authorization on Attachment Retri -
CVE-2026-15916
Drupal core - Moderately critical - Information disclosure -
V. Comments for CVE-2026-79652
No comments yet