CVE-2026-9793CWE-347

CVE-2026-9793

Medium · published May 28, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.4th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-05-28T09:16Z
Affected products (1)
ProductVersionsFixed in
redhat/build_of_keycloakall versions—
References (6)
https://access.redhat.com/errata/RHSA-2026:50846 · [email protected]https://access.redhat.com/errata/RHSA-2026:50847 · [email protected]https://access.redhat.com/errata/RHSA-2026:50848 · [email protected]https://access.redhat.com/errata/RHSA-2026:50849 · [email protected]https://access.redhat.com/security/cve/CVE-2026-9793 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2482460 · [email protected]
EPSS history
Timeline
  • 28 MAY 03:44Z
    Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing
    cvelistv5