CVE-2026-117627: Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions
A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.
Other sources
A vulnerability was found in Keycloak where the JWT Authorization Grant (RFC 7523) fails to enforce login restrictions configured on OIDC or Google identity providers. Specifically, restrictions such as Filtered by claims or Hosted Domain are bypassed when the grant is processed. An authenticated confidential client with the JWT Authorization Grant enabled can submit a signed assertion for an existing federated user and receive realm tokens, even if the assertion contains claims that violate the identity provider's security policies. An attacker with client credentials and a validly signed assertion can bypass intended access controls to obtain unauthorized realm access for federated users.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments are exposed when they use OIDC or Google identity providers with login restrictions such as claim filtering or Hosted Domain, and have a confidential client with the JWT Authorization Grant enabled. The issue concerns existing federated users whose identity-provider claims would normally prevent login.
What does an attacker need to exploit it?
An attacker needs authenticated access as a confidential client, including client credentials, and a validly signed JWT assertion for an existing federated user. No user interaction is required.
Which login controls can be bypassed?
The JWT-based grant flow can bypass identity-provider restrictions including Filtered by claims and Hosted Domain. These restrictions remain applied during standard browser logins, but are skipped for the JWT Authorization Grant flow.
What is the impact of a successful exploit?
An attacker can obtain realm access tokens for a federated user whose identity-provider claims should have blocked that user from logging in. The stated impact includes unauthorized realm access and low confidentiality and integrity impact.