Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users (CVE-2026-1609)

CVE-2026-1609 is an improper access control vulnerability in Keycloak 26.5.2 related to the JWT authorization grant preview feature. When this feature is enabled, Keycloak does not properly check if a user account is disabled during JWT authorization grant processing. An attacker with low privileges can present a valid assertion token from an external identity provider to obtain a JWT for a disabled user, thereby gaining unauthorized access to sensitive resources. The vulnerability is addressed in Keycloak 26.5.3. Red Hat's downstream products are not affected as they do not ship this preview feature.

The vulnerability allows unauthorized access to sensitive resources by bypassing disabled user account checks during JWT authorization grant processing. This could lead to privilege escalation and unauthorized resource access. However, the impact is limited to environments where the JWT authorization grant preview feature is explicitly enabled. Red Hat products are unaffected at this time.

To mitigate this issue, ensure that the 'jwt-authorization-grant' preview feature is not enabled in Keycloak deployments. This feature is disabled by default. If enabled, disable it and restart the Keycloak service for the change to take effect. Additionally, upgrade to Keycloak version 26.5.3 or later where the vulnerability is fixed.