CVEvulnerability

CVE-2026-9793

7.5 HIGH Published 2026-05-28 Modified 2026-10-26 Official page ↗
Status
Modified
Published
2026-05-28
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.9 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-347

Description

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.

Affected configurations

• redhat build of keycloak

Related

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References