Executive brief
Keycloak is an open-source identity and access management solution used to secure modern applications and services. A security flaw was identified where the system fails to check if a user account has been disabled when using a specific login feature (JWT authorization grant). This allows a person with a disabled account to still log in and access sensitive corporate data or restricted resources by using a valid credential from an external identity provider.
Technical details
An improper access control vulnerability exists in Keycloak when the '--features jwt-authorization-grant' preview feature is enabled. The root cause is a failure to validate the 'enabled' status of a user account during the processing of a JWT authorization grant. A remote attacker with low privileges can present a valid assertion token from an external identity provider to obtain a new JWT for a disabled user account. This allows the attacker to bypass account suspension and access protected endpoints. The issue is fixed in Keycloak version 26.5.3.
Affected products
- Keycloak Keycloak 26.5.0 to 26.5.2
- Red Hat Red Hat JBoss Enterprise Application Platform 8 Affected
- Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Affected
Timeline
- 2026-01-29: disclosed: Initial bug report in Red Hat Bugzilla
- 2026-02-10: patched: Fixed in Keycloak version 26.5.3
- 2026-07-16: advisory: NVD publication date