CVE-2026-1609: Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.
Other sources
Improper access control vulnerability in the JWT authorization grant preview feature of Keycloak. The issue occurs when the --features jwt-authorization-grant option is enabled, and a user account is disabled. Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. By presenting a valid assertion token from an external identity provider, an attacker can obtain a JWT for a disabled user and use it to access protected endpoints. This can be exploited remotely with low privileges and no user interaction, resulting in unauthorized access to sensitive resources.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If the JWT authorization grant preview feature is not required, disable it (do not run Keycloak with the --features jwt-authorization-grant option), especially when any user accounts are disabled.
Keycloak --features = jwt-authorization-grant - Compensating control
Ensure disabled users cannot authenticate via JWT authorization grant processing by disabling the jwt-authorization-grant feature until the underlying access control validation is fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1609?
The severity of CVE-2026-1609 is rated high with a score of 8.1.
How do I fix CVE-2026-1609?
To fix CVE-2026-1609, ensure that the JWT authorization grant preview feature is properly configured and consider disabling it if not in use.
What type of attack is possible with CVE-2026-1609?
CVE-2026-1609 allows a remote attacker with low privileges to gain unauthorized access to disabled user accounts through JWT authorization.
What software is affected by CVE-2026-1609?
CVE-2026-1609 affects the Keycloak and the Red Hat Build of Keycloak.
When was CVE-2026-1609 published?
CVE-2026-1609 was published on January 29, 2026.