CVE-2026-11800: Keycloak JWT Algorithm Confusion Vulnerability Allows Federated User Impersonation

Technical summary

CVE-2026-11800 is a JWT algorithm confusion vulnerability (CWE-347) affecting Keycloak's JWT Authorization Grant flow. The vulnerability stems from improper validation of the JWT signing algorithm, allowing an authenticated attacker (one holding valid client credentials) to forge JWTs that bypass signature verification checks. By submitting a malicious assertion during the OAuth 2.0/OIDC flow, an attacker can generate valid access tokens on behalf of any federated user associated with the compromised Identity Provider. The attack does not require user interaction and operates within network boundaries.

Business impact

This vulnerability creates a critical authentication bypass that undermines the trust model of federated identity systems. Organizations using Keycloak as an identity provider face the risk of unauthorized access to downstream applications and services by attackers who obtain or already control a legitimate service account. The ability to impersonate any federated user elevates the threat from application-level compromise to enterprise-wide identity breach, with potential exposure of sensitive data, lateral movement opportunities, and privilege escalation depending on the permissions assigned to impersonated users.

Affected systems

Red Hat build of Keycloak is the confirmed affected product. Organizations running Keycloak instances as authentication backends—particularly those in federated identity scenarios with linked external identity providers—are in scope. The vulnerability requires the attacker to hold valid client credentials, limiting the attack surface to scenarios where service account secrets have been compromised, leaked, or mismanaged.

Exploitability

The vulnerability has a CVSS 3.1 score of 8.1 (HIGH) with a network-based attack vector, low attack complexity, and a requirement for low privileges (valid client credentials). No user interaction is required. While the attack requires prior compromise of client credentials, once those are obtained, exploitation is straightforward and automated. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, though public disclosure may increase threat activity.

Remediation

Remediation requires patching Keycloak to a version that properly validates JWT algorithm selection and enforces signature verification. Verify the specific patched version against the Red Hat security advisory. Concurrent mitigation steps include rotating all service account credentials, reviewing access logs for suspicious token generation patterns, auditing federated user accounts for unauthorized activity, and restricting client credential distribution to essential service accounts only.

Patch guidance

Apply the security patch provided by Red Hat for your Keycloak deployment. Before patching, document your current Keycloak version and verify compatibility with your environment. Test patches in a non-production environment first, particularly if custom JWT handlers or authorization grant extensions are in use. After patching, restart Keycloak services to ensure the fix is active. Verify the patch version against the official Red Hat security advisory to confirm you are applying the correct remediation.

Detection guidance

Monitor authentication logs for JWT assertions with algorithm confusion indicators—specifically, detection of algorithm mismatches between expected and presented JWT headers. Look for authorization grant requests containing forged or unsigned assertions. Review token issuance logs for unusual patterns, such as multiple tokens issued to the same user within short timeframes or tokens issued for users that did not initiate a login flow. SIEM rules should flag failed signature verification attempts followed by successful token issuance, which would indicate a bypass. Implement alerting on client credential usage from unexpected IP addresses or at unusual hours.

Why prioritize this

This vulnerability merits immediate priority due to its HIGH CVSS score (8.1), the direct impact on identity and access control, and the ability to impersonate any federated user once exploited. Although exploitation requires valid client credentials, the consequences of compromise are severe—wholesale authentication bypass affecting all downstream services. The lack of user interaction and network accessibility increase the attack surface. Prioritize patching if your organization uses Keycloak in a federated identity configuration or exposes it to the internet.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact (the attacker can access any user's resources and modify authorization state), low attack complexity, and a network-based attack vector. The score is moderated only by the requirement for low-privilege credentials (a valid client account). In an enterprise context, this translates to widespread risk because a single compromised service account enables impersonation of any federated user, bypassing the entire cryptographic trust model of JWT-based authentication.

Frequently asked questions