CVE-2026-9793 Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing
Remote attackers can bypass signature policies in Keycloak's JWE processing to submit unauthorized claims, compromising OIDC data integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9793?
CVE-2026-9793 is a medium-severity vulnerability in Redhat Build of Keycloak, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.
Weakness: CWE-347
Which versions are affected by CVE-2026-9793?
2 open source packages ship an affected version, including org.keycloak:keycloak-services. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.keycloak:keycloak-services Maven | All versions to 26.6.4 | None |
org.keycloak:keycloak-services Maven | All versions to 26.6.4 | None |
Products include Redhat Build of Keycloak.
How do I fix CVE-2026-9793?
Apply the vendor's patch.
Is CVE-2026-9793 being exploited?
There is no known exploitation of CVE-2026-9793 in the wild and no public exploit code.
Other vulnerabilities in Redhat Build of Keycloak
- CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- CVE-2026-3047 Keycloak SAML Broken has Authentication Bypass by Primary Weakness
- CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
- CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
Sources
Also known as ECHO-70df-01df-0cb2, GHSA-p3v8-fm5p-v84h, MINI-gv76-rvvc-9gpw, MINI-j3jm-973v-9q3c.