CVE-2026-9792: Keycloak security bypass in Client Policies OIDC component

CVE-2026-9792 · Severity: medium · CVSS 6.5 · Published 2026-05-28

Keycloak, an open-source identity and access management solution, contains a security flaw in how it enforces client policies. An attacker can bypass restrictions intended to block the Resource Owner Password Credentials (ROPC) grant, allowing them to obtain security tokens even when specifically prohibited by administrators. This could lead to unauthorized access to user accounts and sensitive information disclosure.

Technologies: Keycloak, org.keycloak:keycloak-services (Maven), Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-9792 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9792 being exploited in the wild.
How severe is CVE-2026-9792?
Medium severity, with a CVSS score of 6.5, published 28 May 2026.
Which products and versions are affected?
Keycloak >= 26.5.0, < 26.6.3; org.keycloak:keycloak-services (Maven) ECOSYSTEM:introduced=26.5.0,fixed=26.6.3; Red Hat build of Keycloak 26.6, 26.4.
Is there a fix for CVE-2026-9792?
Yes. org.keycloak:keycloak-services (Maven): upgrade to 26.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9792 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-9792?
Check whether you run Keycloak, org.keycloak:keycloak-services (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.keycloak:keycloak-services (Maven): upgrade to 26.6.3 or later
    # set org.keycloak:keycloak-services to 26.6.3 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Keycloak's Client Policies within the `org.keycloak.protocol.oidc` component. When security restrictions are enforced using condition providers such as client-type, client-roles, client-attributes, or client-scopes, the `reject-ropc-grant` executor is silently bypassed. This allows a remote, unauthenticated attacker to successfully perform a Resource Owner Password Credentials (ROPC) grant even if a policy is explicitly configured to block it. The flaw stems from improper handling of insufficient permissions or privileges (CWE-280). A fix is available in Keycloak version 26.6.3 and corresponding Red Hat builds.

Affected products

  • Keycloak Keycloak >= 26.5.0, < 26.6.3
  • Keycloak Keycloak <= 26.4.7
  • Red Hat Red Hat build of Keycloak 26.6, 26.4

Identifiers

  • CVE-2026-9792
  • GHSA-33j3-g875-37rp

Timeline

  • 2026-05-28: disclosed: Initial disclosure and NVD publication
  • 2026-05-28: advisory: GHSA-33j3-g875-37rp published
  • 2026-06-10: patched: Red Hat released security advisory RHSA-2026:25098 for Keycloak 26.6.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.