CVE-2026-117627

MediumCVSS 5.4/10Last modified Nov 3, 2026

Description

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	—
Red Hat	Red Hat Build of Keycloak	—
Red Hat	Red Hat Single Sign-On 7	—

References

Timeline

Published: Oct 29, 2026
Last modified: Nov 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-117636.5Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Service CVE-2026-1176356.5The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokens. A public-only token with admin scop CVE-2026-117643.6When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating th CVE-2026-1176455.3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows a CVE-2026-1176464.3The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included private repositories CVE-2026-1176493.5The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency CVE-2026-117653.3Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Res CVE-2026-1176569.3Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unau CVE-2026-117668.0The Ultimate Member WordPress plugin before 2.12.0 does not properly sanitise and escape the value of custom textarea profile fields before CVE-2026-1176669.1Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to imp CVE-2026-117678.8The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and CVE-2026-1176776.5When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting