CVE-2026-79652 Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired
An attacker with valid client credentials can bypass user consent requirements in the JWT Bearer grant to gain unauthorized access to user accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79652?
CVE-2026-79652 is a medium-severity missing authorization vulnerability in Red Hat Single Sign-On 7, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client.
Weakness: CWE-862
Which versions are affected by CVE-2026-79652?
How do I fix CVE-2026-79652?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-79652 being exploited?
There is no known exploitation of CVE-2026-79652 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-BB61412, GHSA-9f9p-c2v5-98rx.