CVE-2026-79652 in Keycloak
Summary
by MITRE • 08/25/2026
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified in Red Hat Build of Keycloak, specifically within the keycloak-services component, represents a critical failure in the enforcement of OAuth2 authorization policies during the JWT Bearer grant flow. This specific implementation flaw allows an attacker to bypass user consent requirements when obtaining access tokens for clients that mandate such consent. The core issue lies in the logic governing how identity provider assertions are processed and translated into access tokens. When a client application requests an access token using the OAuth2 JWT Bearer Grant type, it typically presents a signed assertion from a trusted Identity Provider to prove its authority on behalf of a user or itself. In this vulnerable scenario, the Keycloak service fails to verify whether the target resource server requires explicit user consent before issuing the final access token. This oversight creates a significant gap in the security boundary between authentication and authorization, allowing tokens to be issued without the necessary human-in-the-loop approval that is standard for sensitive applications.
From a technical perspective, this flaw constitutes an Authorization Bypass through User Interface Misinterpretation or Logic Error, aligning with CWE-287 which covers Improper Authentication, but more specifically it maps to CWE-613 Insufficient Session Expiration and CWE-940 in the context of flawed authorization logic. The attacker leverages valid client credentials along with a trusted identity provider assertion to initiate the grant flow. Because Keycloak does not check for pending consent requirements associated with the requesting client, it proceeds to issue an access token that grants permissions which should have been blocked until user interaction occurs. This effectively neutralizes one of the primary security controls in OpenID Connect and OAuth2 ecosystems designed to prevent unauthorized data exposure by ensuring users are aware of and approve the scopes being requested.
The operational impact of this vulnerability is severe, particularly for organizations using Keycloak as an identity provider for applications that handle sensitive personal or financial data. An authenticated attacker who possesses valid client credentials can exploit this flaw to obtain access tokens without user consent. This enables unauthorized access to user accounts at consent-gated clients, potentially leading to full account takeover if the granted scopes include high-privilege permissions such as reading private profile information, modifying settings, or accessing other protected resources. The attack is stealthy because it does not involve brute force or injection techniques but rather exploits a logical omission in the token issuance process, making it difficult to detect through standard intrusion detection systems that focus on malicious payloads rather than protocol logic violations.
This vulnerability maps directly to MITRE ATT&CK technique T1078 Valid Accounts and specifically relates to the Initial Access and Persistence tactics where attackers use legitimate credentials to gain footholds in a system. By bypassing consent, the attacker maintains access under the guise of a valid OAuth2 flow, which may evade security monitoring tools that trust standard protocol behaviors. The lack of user intervention means that victims are unaware their data is being accessed or shared with unauthorized third-party applications, violating principles of transparency and control mandated by privacy regulations such as GDPR and CCPA.
Mitigation strategies must focus on ensuring that the consent check logic is correctly implemented in all grant types handled by Keycloak services. Administrators should verify that they are running a patched version of Red Hat Build of Keycloak where this logical flaw has been corrected to enforce consent checks prior to token issuance for JWT Bearer grants. Additionally, organizations should review their client configurations to ensure that only necessary scopes are requested and that multi-factor authentication is enabled for high-risk applications to add an additional layer of verification beyond simple credential possession. Regular auditing of access logs can help detect unusual patterns of token requests from clients that typically require consent but do not exhibit corresponding user interaction events, providing a compensating control until the software patch is applied.