REDHAT-BUG-2487006: High severity Keycloak Keycloak vulnerability
A JWT algorithm confusion vulnerability was found in Keycloak's JWT Authorization Grant flow . A flaw in the signature verification logic allows an attacker with valid client credentials to submit a forged assertion using alg=HS256 with the Identity Provider's public key bytes as the HMAC secret, bypassing asymmetric signature verification. This enables the attacker to mint access tokens and impersonate any federated user linked to the affected IdP. The vulnerability requires an IdP configured with jwtAuthorizationGrantEnabled=true, a hardcoded public key (useJwksUrl=false), and no pinned assertion signature algorithm (the default).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the JWT Authorization Grant flow by setting jwtAuthorizationGrantEnabled=false on the IdP to prevent the JWT Authorization Grant flow from being used for this algorithm confusion attack.
Keycloak (JWT Authorization Grant flow / Identity Provider configuration) jwtAuthorizationGrantEnabled = false - Configuration
Avoid the vulnerable configuration that uses a hardcoded public key by setting useJwksUrl=true instead of useJwksUrl=false (the latter corresponds to the described vulnerable setup).
Keycloak (Identity Provider configuration) useJwksUrl = true - Configuration
Configure assertion verification to require a pinned assertion signature algorithm (the default leaves it unpinned, which is required for exploitation per the description).
Keycloak (JWT Authorization Grant flow / assertion verification) pinned assertion signature algorithm = set to a specific asymmetric algorithm
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487006?
The severity of REDHAT-BUG-2487006 is high, rated at 7.
What type of vulnerability is REDHAT-BUG-2487006?
REDHAT-BUG-2487006 is a JWT algorithm confusion vulnerability found in Keycloak's JWT Authorization Grant flow.
How can I mitigate REDHAT-BUG-2487006?
Mitigation for REDHAT-BUG-2487006 involves ensuring proper validation of JWT signatures and avoiding the use of insecure algorithm configurations.
What are the potential impacts of REDHAT-BUG-2487006?
The potential impacts of REDHAT-BUG-2487006 include unauthorized access to resources through forged JWT assertions.
Which software is affected by REDHAT-BUG-2487006?
REDHAT-BUG-2487006 affects Keycloak software specifically within its JWT Authorization Grant flow.