CVE-2026-11800
Full vulnerability record from the local CVENow database.
Description
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.
Severity
HIGH
CVSS score
8.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-25 22:17:00.473000
Last modified
2026-10-25 22:10:00.150000
View original CVE JSON
{
"id": "CVE-2026-11800",
"sourceIdentifier": "[email protected]",
"published": "2026-06-25T22:17:00.473",
"lastModified": "2026-10-25T22:10:00.150",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation."
},
{
"lang": "es",
"value": "Se encontró un fallo en Keycloak. Esta vulnerabilidad de confusión de algoritmo JWT en el flujo de concesión de autorización JWT permite a un atacante con credenciales de cliente válidas eludir la verificación de firma. Al falsificar una aserción, el atacante puede crear tokens de acceso no autorizados. Esto permite al atacante suplantar a cualquier usuario federado vinculado al Proveedor de Identidad afectado, lo que lleva a un acceso no autorizado y una potencial escalada de privilegios."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"versions": [
{
"version": "26.6.4-2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"versions": [
{
"version": "26.6-8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"versions": [
{
"version": "26.6-8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6.4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Data Grid 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-services",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "keycloak-services",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-services",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"versions": [
{
"version": "26.6.4-2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"versions": [
{
"version": "26.6-8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
],
"versions": [
{
"version": "26.6-8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6.4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Data Grid 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-services",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-services",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-services",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-26T13:03:46.141909Z",
"id": "CVE-2026-11800",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*",
"versionStartIncluding": "26.6",
"versionEndExcluding": "26.6.4",
"matchCriteriaId": "EC1CC78D-43C0-4F1E-AC80-6B302F992816"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:30083",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30084",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-11800",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487006",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30083",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:30084",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-11800",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487006",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11800.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"tags": [
"Vendor Advisory"
]
}
]
}