REDHAT-BUG-2435257: High severity Keycloak Keycloak vulnerability
Improper access control vulnerability in the JWT authorization grant preview feature of Keycloak. The issue occurs when the --features jwt-authorization-grant option is enabled, and a user account is disabled. Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. By presenting a valid assertion token from an external identity provider, an attacker can obtain a JWT for a disabled user and use it to access protected endpoints. This can be exploited remotely with low privileges and no user interaction, resulting in unauthorized access to sensitive resources.
Affected Software
Event History
Frequently Asked Questions
Which Keycloak deployments are exposed?
Deployments are affected when the JWT authorization grant preview feature is enabled with the --features jwt-authorization-grant option and disabled user accounts exist. The issue is specific to JWT authorization grant processing.
What does an attacker need to exploit this issue?
An attacker needs a valid assertion token for a disabled user from an external identity provider. Exploitation is remote, requires low privileges, and does not require user interaction.