CVE-2026-11800

HighCVSS 8.1/10Last modified Oct 25, 2026

Description

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

VendorProductVersions
Red HatRed Hat build of Keycloak 26.6—
Red HatRed Hat build of Keycloak 26.6—
Red HatRed Hat build of Keycloak 26.6—
Red HatRed Hat build of Keycloak 26.6.4—
Red HatRed Hat Build of Keycloak—
Red HatRed Hat Build of Keycloak—
Red HatRed Hat Data Grid 8—
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack—
Red HatRed Hat Single Sign-On 7—
Red HatRed Hat build of Keycloak 26.6—
Red HatRed Hat build of Keycloak 26.6—
Red HatRed Hat build of Keycloak 26.6—
Red HatRed Hat build of Keycloak 26.6.4—
Red HatRed Hat Build of Keycloak—
Red HatRed Hat Build of Keycloak—
Red HatRed Hat Data Grid 8—
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack—
Red HatRed Hat Single Sign-On 7—

References

Timeline

Published
Jun 25, 2026
Last modified
Oct 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1180008.1Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, aCVE-2026-1180028.1Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, ThCVE-2026-1180038.1Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, anCVE-2026-1180048.1Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.CVE-2026-1180058.8Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180068.8Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 1CVE-2026-1180078.8Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Thunderbird 159, Firefox ESR 153.7, and ThunderCVE-2026-1180088.8Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180098.8Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-118017.5The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. TCVE-2026-1180108.8Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.CVE-2026-1180118.8Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-11800: High severity, CVSS 8.1 | Vulnix