CVE-2026-1609
published 2026-07-16CVE-2026-1609: A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to…
PriorityP356high8.1CVSS 3.1
AVNACLPRLUINSUCHIHAN
EPSS
0.56%
46.0th percentile
A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| keycloak | keycloak | >= 26.5.0 < 26.5.3 | 26.5.3 |
| redhat | build_of_keycloak | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcutil-fips: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion
vendor_redhat·2026-08-03·CVSS 8.7
CVE-2026-59645 [HIGH] CWE-835 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcutil-fips: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion
org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcutil-fips: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
A flaw was found in Bouncy Castle for Java. A remote attacker could exploit this vulnerability by providing a specially crafted self-referential IEEE 1609.2 schema to the OER (Octet Encoding Rules) parser. This can cause the parser to recurse without a depth limit, leading to resource exhaustion and a denial of service (DoS) for the affected system.
Statement: B
Red Hat
org.keycloak/keycloak-quarkus-server: Keycloak: Unauthorized Access via JWT authorization grant with disabled users
vendor_redhat·2026-02-09·CVSS 8.1
CVE-2026-1609 [HIGH] CWE-284 org.keycloak/keycloak-quarkus-server: Keycloak: Unauthorized Access via JWT authorization grant with disabled users
org.keycloak/keycloak-quarkus-server: Keycloak: Unauthorized Access via JWT authorization grant with disabled users
A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.
Statement: The Red Hat Product Security team has assessed this vulnerability as High severity; however, it only affects upstream Keycloak version 26.5.2, which includes a preview JWT auth
GHSA
A flaw was found in Keycloak.
ghsa_unreviewed·2026-07-16
CVE-2026-1609 [HIGH] CWE-284 A flaw was found in Keycloak.
A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.
VulDB
Red Hat Keycloak JWT Authorization Grant Processing improper authorization
vuldb·2026-07-16·CVSS 8.1
CVE-2026-1609 [HIGH] Red Hat Keycloak JWT Authorization Grant Processing improper authorization
A vulnerability categorized as problematic has been discovered in Red Hat Keycloak. Impacted is an unknown function of the component JWT Authorization Grant Processing. Executing a manipulation can lead to improper authorization.
This vulnerability is registered as CVE-2026-1609. It is possible to launch the attack remotely. No exploit is available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59645 byte-buddy: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
bugzilla·2026-08-25·CVSS 8.7
CVE-2026-59645 [HIGH] CVE-2026-59645 byte-buddy: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
CVE-2026-59645 byte-buddy: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
Bugzilla
CVE-2026-59645 resteasy: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
bugzilla·2026-08-25·CVSS 8.7
CVE-2026-59645 [HIGH] CVE-2026-59645 resteasy: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
CVE-2026-59645 resteasy: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
Bugzilla
CVE-2026-59645 jglobus: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
bugzilla·2026-08-25·CVSS 8.7
CVE-2026-59645 [HIGH] CVE-2026-59645 jglobus: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
CVE-2026-59645 jglobus: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
Bugzilla
CVE-2026-59645 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcutil-fips: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion
bugzilla·2026-08-03·CVSS 8.7
CVE-2026-59645 [HIGH] CVE-2026-59645 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcutil-fips: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion
CVE-2026-59645 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcutil-fips: Bouncy Castle for Java: Denial of Service via OER parser unbounded recursion
In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcutil-fips 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series).
https://access.redhat.com/security/cve/CVE-2026-1609https://bugzilla.redhat.com/show_bug.cgi?id=2435257https://github.com/keycloak/keycloak/issues/46144https://github.com/keycloak/keycloak/releases/tag/26.5.3https://access.redhat.com/security/cve/CVE-2026-1609https://bugzilla.redhat.com/show_bug.cgi?id=2435257https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1609.json
2026-07-16
Published