JWT Bearer Authorization Flaw in Red Hat Build of Keycloak

CVE-2026-79652

What is CVE-2026-79652?

A vulnerability has been identified in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This issue arises due to inadequate validation of client consent requirements when issuing access tokens. An authenticated attacker possessing valid client credentials can exploit this flaw to bypass the necessary consent checks, thereby gaining unauthorized access to user accounts at consent-gated clients. This compromises the integrity and privacy of user data, highlighting the necessity for timely remediation and robust security practices.

References