CVE-2026-79652: Missing Authorization in Red Hat Red Hat build of Keycloak 26.6

This vulnerability arises because the JWT Bearer grant implementation in Red Hat build of Keycloak fails to enforce the consentRequired configuration flag. As a result, the system does not check if a client requires user consent before issuing an access token. An attacker who is authenticated with valid client credentials and a trusted identity provider assertion can bypass the consent step and gain unauthorized access to user accounts protected by consent requirements. The issue affects the keycloak-services component handling OAuth2 and OpenID Connect grant types. Red Hat has assessed the severity as moderate due to the specific conditions required for exploitation.

Successful exploitation allows an attacker to bypass user consent requirements and obtain an access token for a target user, leading to unauthorized access to user accounts. The confidentiality impact is high, as sensitive user data could be accessed without consent. The integrity impact is low, and there is no availability impact. Exploitation requires network access, low privileges, and no user interaction, but high attack complexity due to required conditions.

According to the Red Hat advisory, no effective mitigation is currently available that meets criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates on fixes or recommended mitigations. Until an official fix is released, organizations should carefully review client configurations and identity provider assertions to minimize exposure.