Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2026-11800 BIT-keycloak-2026-11800EUVD-2026-39567GHSA-gqj5-2xp5-3qmpGHSA-j97h-3f8r-mrjr

Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

Published Jun 25, 2026 · Updated Jul 15, 2026 · Assigned by redhat

Vendor: Red Hat Product: Red Hat Build of Keycloak Product: Red Hat build of Keycloak 26.6 Product: Red Hat build of Keycloak 26.6.4 Product: Red Hat Data Grid 8 Product: Red Hat JBoss Enterprise Application Platform Expansion Pack Product: Red Hat Single Sign-On 7 Package: org.keycloak:keycloak-services Ecosystem: Maven

Description

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.

Affected products

VendorProductAffectedFixed
Red Hat Red Hat build of Keycloak 26.6 — —
Red Hat Red Hat build of Keycloak 26.6.4 — —
Red Hat Red Hat Build of Keycloak — —
Red Hat Red Hat Data Grid 8 — —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack — —
Red Hat Red Hat Single Sign-On 7 — —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • sickwell/CVE-2026-11800 ★ 0 · Nov 10, 2026

    PoC for CVE-2026-11800: Keycloak JWT algorithm confusion auth bypass (HS256 assertion signed with the IdP public RSA key). Fixed in Keycloak 26.6.4.

  • fixedbyreboot/CVE-2026-11800-POC ★ 0 · Nov 10, 2026

    POC for CVE-2026-11800 - JWT algorithm confusion in Keycloak identity brokering: the IdP RSA public key DER bytes are accepted as an HMAC secret, minting tokens for federated users without any privat…

  • federiconbaez/cortex9-keycloak-jwt-grant-alg-confusion-model ★ 0 · Nov 9, 2026

    Offline differential model of Keycloak JWT grant HMAC algorithm confusion (CVE-2026-11800), educational

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.keycloak:keycloak-services < 26.6.4 26.6.4 GHSA-j97h-3f8r-mrjr

Advisories 1

References