JWT Algorithm Confusion in Keycloak Affects User Access Control
CVE-2026-11800

8.1HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Build Of Keycloak 26.6; Red Hat Build Of Keycloak 26.6.4; Red Hat Build Of Keycloak; Red Hat Data Grid 8
Vendor: CVE Published:; 25 June 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-11800?

A flaw has been identified in Keycloak that allows attackers with valid client credentials to exploit a weakness in the JWT Authorization Grant flow. This vulnerability permits an attacker to bypass signature verification and forge access tokens. Consequently, the attacker can impersonate any federated user associated with the compromised Identity Provider, resulting in unauthorized access and the potential for privilege escalation.

Affected Version(s)

Red Hat build of Keycloak 26.6 26.6.4-2

Red Hat build of Keycloak 26.6 26.6-8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cortex9-keycloak-jwt-grant-alg-confusion-model
Created by federiconbaez