Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-25 | 2 | Disclosure2 |
| 2026-06-26 | 2 | Disclosure2 |
| 2026-07-02 | 1 | Patch1 |
I told Keycloak how to verify the token. It listened :) CVE-2026-11800: algorithm confusion in the JWT Authorization Grant flow. Forge an assertion, become any federated user. Patched. https://access.redhat.com/security/cve/cve-2026-11800
Post summary
The tweet announces that Keycloak's CVE‑2026‑11800, an algorithm confusion vulnerability allowing forged JWTs, has been patched.
CVE-2026-11800 A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypas… https://www.cve.org/CVERecord?id=CVE-2026-11800
Post summary
The post announces a JWT algorithm confusion flaw in Keycloak’s JWT Authorization Grant flow, describing how attackers with valid client credentials could bypass security, but provides no PoC, exploit details, patch, or evidence of active exploitation.
CVE-2026-11800 Red Hat Keycloak A JWT algorithm confusion flaw can enable turning identity federation into an access-control risk Full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-25/TIER_2_CVE-2026-11800.md #CyberSecurity #IdentitySecurity #VulnerabilityManagement
Post summary
The report announces a JWT algorithm confusion flaw in Red Keycloak that could turn identity federation into an access‑control risk, but it provides no PoC, exploit, or patch details.
🚨 HIGH - Keycloak JWT algorithm confusion lets attackers mint unauthorized tokens (CVE-2026-11800) A JWT algorithm confusion flaw impacts Keycloak’s JWT Authorization Grant flow, allowing crafted JWT assertions to bypass signature verification during token issuance. The root cause is improper JWT algorithm handling/validation (algorithm confusion) leading to signature verification being skipped or performed incorrectly. An attacker with valid client credentials can exploit this by submitting a forged assertion via the grant flow to mint access tokens without a valid signature, under conditions where JWT auth grants and a federated IdP linkage are in use. Real-world impact includes unauthorized access token issuance, impersonation of federated users tied to the affected identity provider, and resulting privilege escalation across protected applications and APIs. 👉 Affected: Keycloak; rhbk/keycloak-operator-bundle; rhbk/keycloak-rhel9; rhbk/keycloak-rhel9-operator; rhbk-openshift-rhel9/rhbk-openshift-rhel9 | No fix yet - treat as suspicious
Post summary
The advisory announces CVE-2026-11800, describing a JWT algorithm confusion flaw that lets attackers mint unauthorized access tokens via the Keycloak grant flow, with no patch or PoC and no evidence of active exploitation.
🚨*CVE* CVE-2026-11800 A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypas… https://www.cve.org/CVERecord?id=CVE-2026-11800 ----- Traducción: CVE-2026-11800 Se … http://infoflow.cloud`
Post summary
The tweet announces a newly discovered Keycloak vulnerability involving JWT algorithm confusion, providing basic technical details but no PoC, exploit code, patch, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | redhat | build_of_keycloak | - | - | - |