CVE-2026-1609

HIGH 8.1

Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.

CWE	CWE-284
Vendor	keycloak
Product	keycloak
Published	Jul 16, 2026
Last Updated	Jul 16, 2026

Stay Ahead of the Next One

Get instant alerts for keycloak keycloak

Be the first to know when new high vulnerabilities affecting keycloak keycloak are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

Keycloak / Keycloak

26.5.0 < 26.5.3

Red Hat / Red Hat JBoss Enterprise Application Platform 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform 8

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Pack

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Pack

All versions affected

Red Hat / Red Hat JBoss Enterprise Application Platform Expansion Pack

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-1609 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2435257 github.com: https://github.com/keycloak/keycloak/issues/46144 github.com: https://github.com/keycloak/keycloak/releases/tag/26.5.3 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1609.json

Credits

Red Hat would like to thank Joy Gilbert and Reynaldo Immanuel for reporting this issue.