Quick answers
- Is CVE-2026-1609 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-1609 being exploited in the wild.
- How severe is CVE-2026-1609?
- High severity, with a CVSS score of 8.1, published 16 July 2026.
- Which products and versions are affected?
- Keycloak 26.5.0 to 26.5.2.
- Is there a fix for CVE-2026-1609?
- A patch was published on 2026-02-10: Fixed in Keycloak version 26.5.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-1609 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-1609?
- Check whether you run Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An improper access control vulnerability exists in Keycloak when the '--features jwt-authorization-grant' preview feature is enabled. The root cause is a failure to validate the 'enabled' status of a user account during the processing of a JWT authorization grant. A remote attacker with low privileges can present a valid assertion token from an external identity provider to obtain a new JWT for a disabled user account. This allows the attacker to bypass account suspension and access protected endpoints. The issue is fixed in Keycloak version 26.5.3.
Affected products
- Keycloak Keycloak 26.5.0 to 26.5.2
- Red Hat Red Hat JBoss Enterprise Application Platform 8 Affected
- Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Affected
Timeline
- 2026-01-29: disclosed: Initial bug report in Red Hat Bugzilla
- 2026-02-10: patched: Fixed in Keycloak version 26.5.3
- 2026-07-16: advisory: NVD publication date