CVE-2026-79652: Missing Authorization in Red Hat Red Hat build of Keycloak 26.6

This vulnerability arises because the JWT Bearer grant implementation in Red Hat build of Keycloak fails to enforce the consentRequired configuration flag, which should require user consent before issuing an access token. As a result, an attacker who is authenticated with valid client credentials and a trusted identity provider assertion can bypass the consent step and gain unauthorized access to user accounts. The issue affects the keycloak-services component responsible for handling OAuth2 and OpenID Connect grant types. The root cause is a missing authorization check in the JWT Bearer grant flow.

Successful exploitation allows an attacker to bypass user consent requirements and obtain access tokens for target users, potentially leading to unauthorized access to sensitive user data. The impact is confidentiality loss (high) and limited integrity impact (low). The vulnerability requires network access, low privileges, and high attack complexity. There is no impact on availability.

According to the Red Hat advisory, no effective mitigation is currently available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates or patches addressing this issue. Until a fix is provided, caution is advised when using the JWT Bearer grant with consent-gated clients and trusted identity providers.