REDHAT-BUG-2523347: Medium severity Keycloak Keycloak vulnerability
A Missing Authorization flaw (CWE-862) was identified in the JWT Bearer authorization grant (urn:ietf:params:oauth:grant-type:jwt-bearer) in Keycloak. The vulnerability exists in the JWTAuthorizationGrantType.process function, which fails to verify the client.isConsentRequired flag or check for a stored UserConsentModel before issuing an access token. While other user-facing grants like Resource Owner Password Credentials (ROPC) explicitly refuse consent-required clients, and interactive grants verify stored consent, the JWT Bearer grant bypasses these checks entirely. To exploit this flaw, an attacker must have access to a confidential client credentials and a valid JWT assertion for a target user signed by an allow-listed Identity Provider (IdP). Successful exploitation allows an attacker to: Obtain a valid access token for a target user without their consent.
Access protected resources and APIs on behalf of the user.
Bypass administrative security policies intended to gate client access behind explicit user approval.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs credentials for a confidential client and a valid JWT assertion for the target user. The assertion must be signed by an allow-listed identity provider.
Which deployments are exposed?
Deployments using the JWT Bearer authorization grant are exposed when a confidential client requires user consent and the environment accepts JWT assertions from an allow-listed identity provider. The flaw is specific to the JWT Bearer grant's missing consent validation.
What is the impact if exploitation succeeds?
An attacker can obtain an access token for the target user without that user's consent. The token can be used to access protected resources and APIs as that user, bypassing policies that require explicit user approval for client access.