REDHAT-BUG-2561959: Medium severity Keycloak Keycloak vulnerability
A vulnerability was found in Keycloak where the JWT Authorization Grant (RFC 7523) fails to enforce login restrictions configured on OIDC or Google identity providers. Specifically, restrictions such as Filtered by claims or Hosted Domain are bypassed when the grant is processed. An authenticated confidential client with the JWT Authorization Grant enabled can submit a signed assertion for an existing federated user and receive realm tokens, even if the assertion contains claims that violate the identity provider's security policies. An attacker with client credentials and a validly signed assertion can bypass intended access controls to obtain unauthorized realm access for federated users.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when they use OIDC or Google identity providers with login restrictions configured, such as Filtered by claims or Hosted Domain, and have the JWT Authorization Grant enabled for an authenticated confidential client.
What does an attacker need to exploit the issue?
The attacker needs confidential-client credentials and a valid signed JWT assertion for an existing federated user. They can then obtain realm tokens even when assertion claims violate the identity provider's configured restrictions.
Is unauthenticated exploitation described?
No. The described attack requires an authenticated confidential client and a validly signed assertion.