Executive brief
Keycloak, a popular identity and access management solution, contains a flaw in its security policy enforcement. Administrators can set policies requiring clients to use secure, signed digital signatures (JWTs) for authentication; however, this protection can be bypassed. An attacker with basic client credentials can use a fake, unsigned header to trick the system into accepting less secure authentication methods, potentially undermining the organization's security standards for application access.
Technical details
A vulnerability in the Secure Client Registration executor within the keycloak-services component allows for a bypass of the signed-JWT assertion policy. The root cause is located in the SecureSigningAlgorithmForSignedJwtExecutor, which incorrectly validates only the 'alg' field in the raw JWT header without verifying the presence of a valid client assertion type or ensuring the client's authenticator is assertion-based. By submitting a crafted request with an unsigned assertion header containing a valid 'alg' field, an authenticated attacker can bypass signature verification. This enables the use of simpler authentication methods (like client secrets) even when administrative policies mandate signed assertions.
Affected products
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory