Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

Etkilenen sürümler2 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-117627 Diğer

Kayıt geçmişi

1. 29 Eki 2026 09:22Yayımlandı

İlgili açıklar

• 5,4 CVE-2026-117859Keycloak-services: keycloak-services: par single-use bypass via flow restart
• 4,2 CVE-2026-118030Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
• 5,3 CVE-2026-117688Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration
• 7,4 CVE-2026-114488Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding
• 6,5 CVE-2026-19610Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean
• 4,2 CVE-2026-114438Keycloak'ta gerekli OTP kaydı, Update User Locale eylem sıralaması nedeniyle atlanabiliyor