# CVE-2026-11800: Keycloak JWT algorithm confusion in JWT Authorization Grant flow

Source: https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-11800 · Severity: high · CVSS 8.1 · Published 2026-06-25

A security vulnerability has been identified in Keycloak, a popular identity and access management solution used to secure web and mobile applications. An attacker with valid client credentials can exploit a flaw in how the system verifies digital signatures to impersonate other users. This could allow an unauthorized person to gain access to sensitive data or take over administrative accounts within the organization.

Technologies: [Keycloak](https://junglewise.ai/threats/technologies/keycloak), [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services), [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-keycloak). Vendors: [Keycloak](https://junglewise.ai/threats/vendors/keycloak), [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-11800 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11800 being exploited in the wild.

**How severe is CVE-2026-11800?** High severity, with a CVSS score of 8.1, published 25 June 2026.

**Which products and versions are affected?** Keycloak < 26.6.4-2; org.keycloak:keycloak-services (Maven) < 26.6.4, ECOSYSTEM:introduced=0,fixed=26.6.4; Red Hat build of Keycloak < 26.6.4-2.

**Is there a fix for CVE-2026-11800?** Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11800 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-11800?** Check whether you run Keycloak, org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.keycloak:keycloak-services (Maven): upgrade to 26.6.4 or later

  ```sh
  # set org.keycloak:keycloak-services to 26.6.4 in your pom.xml or build.gradle
  ```


## Technical details

A JWT algorithm confusion vulnerability exists in Keycloak within the JWT Authorization Grant flow. The flaw resides in the improper verification of cryptographic signatures (CWE-347), where the system may be coerced into using an unintended algorithm for validation. An attacker possessing valid client credentials can forge a JWT assertion to bypass signature verification. This allows for the creation of unauthorized access tokens and the impersonation of any federated user linked to the affected Identity Provider. The vulnerability is remediated in Red Hat build of Keycloak 26.6.4-2 and related container images.

## Affected products

- Red Hat Red Hat build of Keycloak < 26.6.4-2
- Keycloak Keycloak Affected versions prior to 26.6.4-2

## Identifiers

- CVE-2026-11800
- BIT-KEYCLOAK-2026-11800
- GHSA-j97h-3f8r-mrjr

## Timeline

- 2026-06-25: disclosed
- 2026-06-25: advisory
- 2026-06-25: patched

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)
- [https://access.redhat.com/errata/RHSA-2026:30083](https://access.redhat.com/errata/RHSA-2026:30083)
- [https://access.redhat.com/errata/RHSA-2026:30084](https://access.redhat.com/errata/RHSA-2026:30084)
- [https://access.redhat.com/security/cve/CVE-2026-11800](https://access.redhat.com/security/cve/CVE-2026-11800)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2487006](https://bugzilla.redhat.com/show_bug.cgi?id=2487006)

## Related threats

- [Keycloak login-failure storage synchronization error in MySQL/MariaDB](https://junglewise.ai/threats/cve-2026-112201-a-flaw-was-found-in-the-login-failure-storage-component-of)
- [Keycloak PKCE bypass in login after password reset](https://junglewise.ai/threats/cve-2026-125652-a-flaw-was-found-in-the-keycloak-services-component-of-keycloak)
- [Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management)
- [Keycloak token sanitization bypass in protocol mapper](https://junglewise.ai/threats/cve-2026-97848-a-flaw-was-found-in-the-token-sanitization-logic-of-keycloak-an)
- [Keycloak Dynamic Client Registration privilege escalation](https://junglewise.ai/threats/cve-2026-96547-a-flaw-was-found-in-the-dynamic-client-registration-component-of)