The vulnerability CVE-2026-11800 affects Red Hat build of Keycloak 26.6 and arises from improper verification of cryptographic signatures in the JWT Authorization Grant flow. Specifically, a JWT algorithm confusion flaw allows an attacker possessing valid client credentials to bypass signature verification by forging assertions. This enables the attacker to generate unauthorized access tokens and impersonate federated users linked to the Identity Provider, leading to unauthorized access and potential privilege escalation. Red Hat has acknowledged this issue and released security updates in version 26.6.4, which include fixes for this vulnerability among others. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No known exploits in the wild have been reported at the time of publication. The vendor advisory URLs provide detailed information and the updated packages.

Successful exploitation allows an attacker with valid client credentials to bypass JWT signature verification, enabling creation of unauthorized access tokens. This leads to impersonation of any federated user linked to the affected Identity Provider, resulting in unauthorized access and potential privilege escalation within systems relying on Keycloak for authentication and authorization.

Red Hat has released fixed packages in Red Hat build of Keycloak version 26.6.4 that address CVE-2026-11800 along with other security vulnerabilities. Users should update to version 26.6.4 as soon as possible. Before applying the update, it is recommended to back up existing installations, including applications, configuration files, and databases. No temporary or alternative mitigations are specified in the vendor advisory. Patch status is confirmed by the vendor advisory.