This vulnerability in Red Hat build of Keycloak (versions before 26.6.4) is a JWT algorithm confusion flaw in the JWT Authorization Grant flow. An attacker possessing valid client credentials can exploit this flaw to bypass signature verification by forging assertions. Consequently, the attacker can generate unauthorized access tokens and impersonate any federated user associated with the compromised Identity Provider. The issue is categorized under CWE-347 (Improper Verification of Cryptographic Signature). The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. Red Hat has published advisories and released version 26.6.4 to address this and other security issues.

Successful exploitation allows attackers with valid client credentials to bypass JWT signature verification, enabling them to forge access tokens and impersonate federated users. This leads to unauthorized access to protected resources and potential privilege escalation within the affected Keycloak environment. The confidentiality and integrity of authentication tokens are compromised, but availability is not impacted.

Red Hat has released an official security update in Red Hat build of Keycloak version 26.6.4 that addresses this vulnerability. Users should upgrade to version 26.6.4 or later to remediate this issue. Before applying the update, back up existing installations including applications, configuration files, and databases. No other temporary or workaround mitigations are specified in the vendor advisories. Patch status is confirmed by Red Hat advisories RHSA-2026:30083 and RHSA-2026:30084.