CVE-2026-79652: Red Hat Keycloak Auth Bypass Vulnerability

CVE-2026-79652 Overview

CVE-2026-79652 is a missing authorization flaw [CWE-862] in the keycloak-services component of Red Hat Build of Keycloak. The vulnerability affects the JWT Bearer authorization grant implementation, which handles OAuth2 and OpenID Connect token issuance. The grant flow fails to verify whether a client requires user consent before issuing an access token. An authenticated attacker with valid client credentials and a trusted identity provider assertion can bypass the consent gate and obtain access to a user account at a consent-gated client.

Critical Impact
Attackers who control valid client credentials and a trusted IdP assertion can obtain tokens for user accounts without the required consent step, gaining unauthorized access to protected resources.

Affected Products

Red Hat Build of Keycloak
keycloak-services component (JWT Bearer grant handler)
OAuth2 and OpenID Connect deployments relying on consent-gated clients

Discovery Timeline

2026-08-25 - CVE-2026-79652 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-79652

Vulnerability Analysis

The flaw resides in the JWT Bearer grant path inside keycloak-services. OAuth2 clients in Keycloak can be marked as requiring explicit user consent before tokens are issued. Other grant flows evaluate that flag and prompt the resource owner. The JWT Bearer grant path skips this evaluation and issues tokens directly once the assertion is validated.

An attacker leveraging this gap must first hold valid client credentials and possess an assertion from a trusted identity provider. These prerequisites raise the attack complexity but do not require any user interaction. The result is unauthorized access to a user account at a consent-gated client, breaking the trust boundary that consent is designed to enforce.

Root Cause

The root cause is a missing authorization check [CWE-862]. The JWT Bearer grant handler does not call the consent-verification logic that other grant handlers use. Consent state stored for the client and user is never consulted before minting the access token.

Attack Vector

Exploitation is network-based. The attacker sends a token request to the Keycloak token endpoint using grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer with a valid signed assertion from a trusted federated identity provider and authenticated client credentials. Keycloak returns an access token for the target user even when the client is configured to require consent. No user is prompted, and no consent record is created.

Refer to the Red Hat CVE-2026-79652 Advisory and Red Hat Bug Report #2523347 for vendor technical detail.

Detection Methods for CVE-2026-79652

Indicators of Compromise

Token endpoint requests using grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer that succeed for clients configured with consentRequired=true.
Access tokens issued to users for consent-gated clients without a matching entry in the user consent store.
Assertions signed by a trusted IdP but presented from client credentials that historically use only interactive flows.

Detection Strategies

Review Keycloak event logs for CODE_TO_TOKEN and TOKEN_EXCHANGE events tied to JWT Bearer grants against consent-required clients.
Correlate token issuance events with the USER_CONSENT events to identify tokens minted without corresponding consent records.
Alert on JWT Bearer grant usage by clients that do not normally use federated assertion flows.

Monitoring Recommendations

Forward Keycloak admin and login events to a centralized log pipeline for retention and correlation.
Baseline JWT Bearer grant volume per client and alert on sudden increases or first-time use.
Monitor identity provider assertion issuance rates for anomalies that could indicate abuse of a trusted IdP.

How to Mitigate CVE-2026-79652

Immediate Actions Required

Apply the Red Hat Build of Keycloak security update referenced in the Red Hat CVE-2026-79652 Advisory once available for your channel.
Audit all clients with consentRequired=true and review recent token issuance for JWT Bearer grants.
Rotate client credentials for any client suspected of abuse and revoke associated refresh tokens.

Patch Information

Red Hat tracks remediation in Red Hat Bug Report #2523347. Consult the vendor advisory for fixed package versions specific to your Red Hat Build of Keycloak channel and apply them through your standard patch process.

Workarounds

Disable the JWT Bearer grant on clients that do not require it by removing urn:ietf:params:oauth:grant-type:jwt-bearer from allowed grant types.
Restrict which identity providers Keycloak trusts for assertion-based flows to reduce the pool of accepted signers.
Tighten client authentication for federated flows, requiring mTLS or private key JWT client authentication where feasible.

bash

# Configuration example: disable JWT Bearer grant for a client via kcadm
kcadm.sh update clients/<client-uuid> -r <realm> \
  -s 'attributes."oauth2.jwt.bearer.grant.enabled"=false'