Executive brief
Red Hat Keycloak is an open-source identity and access management system used to manage user authentication and authorization for enterprise applications. A flaw in its JWT Bearer token grant implementation allows an attacker with valid credentials to bypass user consent checks and gain unauthorized access to accounts at protected applications, potentially enabling account takeover.
Technical details
The vulnerability exists in the keycloak-services component's JWT Bearer authorization grant handler for OAuth2/OpenID Connect flows. The root cause is a missing validation check that fails to verify whether a client has marked user consent as required before issuing an access token. An authenticated attacker with valid client credentials and a trusted identity provider assertion can exploit this to bypass the consent requirement, allowing them to obtain access tokens for user accounts without proper authorization. The attack requires network access to the Keycloak instance and valid credentials but does not require user interaction.
Affected products
- Red Hat Build of Keycloak <UNKNOWN>
Timeline
- 2026-08-25: disclosed