CVE-2026-9793: Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing
A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9793?
The severity of CVE-2026-9793 is rated as medium with a score of 5.9.
How do I fix CVE-2026-9793?
To fix CVE-2026-9793, it is recommended to update Keycloak to the latest version where the vulnerability has been addressed.
What is the risk associated with CVE-2026-9793?
CVE-2026-9793 poses a risk of unauthorized claim submission due to a security policy bypass in processing JWE encrypted request objects.
Can CVE-2026-9793 be exploited remotely?
Yes, CVE-2026-9793 can be exploited remotely since it allows attackers to submit unauthorized claims.
What software is affected by CVE-2026-9793?
CVE-2026-9793 affects Keycloak, specifically in relation to the handling of JWE encrypted request objects.