The vulnerability in Red Hat Build of Keycloak involves improper verification of cryptographic signatures in JWE encrypted request objects. When the decrypted content is raw JSON, Keycloak may incorrectly process unsigned claims, effectively bypassing signature validation policies. This allows a remote attacker to submit unauthorized claims, undermining data integrity in the OIDC authorization process. The issue violates OIDC Core and FAPI signing requirements. A redirect URI allowlist partially mitigates the risk but does not fully address the underlying flaw. There is no vendor advisory indicating an official fix or patch availability as of the published date.

The vulnerability allows remote attackers to submit unauthorized claims by bypassing signature verification in the OIDC authorization flow, leading to a compromise of data integrity. This could affect authentication and authorization decisions relying on these claims. The redirect URI allowlist acts as a compensating control, reducing but not eliminating the risk. There are no known exploits in the wild reported. The impact is limited to integrity; confidentiality and availability are not affected according to the CVSS vector.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9793 for current remediation guidance. Until an official fix is released, rely on the redirect URI allowlist as a compensating control to mitigate risk. Avoid deploying vulnerable versions in high-risk environments where unauthorized claim submission could have significant impact.