A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.
Weakness
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Build_of_keycloak | Redhat | - (including) | - (including) |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-operator-bundle:26.4.14-1 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-rhel9:26.4-22 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-rhel9-operator:26.4-22 | * |
| Red Hat build of Keycloak 26.4.14 | RedHat | rhbk/keycloak-rhel9 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-operator-bundle:26.6.5-1 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-rhel9:26.6-11 | * |
| Red Hat build of Keycloak 26.6 | RedHat | rhbk/keycloak-rhel9-operator:26.6-11 | * |
| Red Hat build of Keycloak 26.6.5 | RedHat | rhbk/keycloak-rhel9 | * |