The vulnerability in Red Hat build of Keycloak 26.4 involves incorrect processing of unsigned claims when a JWE-encrypted request object contains raw JSON plaintext. This bypasses the configured requestObjectSignatureAlg policy, allowing an attacker to submit unauthorized claims and compromise data integrity within the OIDC authorization flow. While a redirect URI allowlist acts as a compensating control preventing full authorization code or token exfiltration, the flaw violates OIDC Core and FAPI signing requirements. Red Hat has published an advisory acknowledging the issue but currently does not provide a patch or official remediation. The CVSS 3.1 base score is 5.9 (medium severity) with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but high integrity impact.

This vulnerability allows a remote attacker to bypass cryptographic signature verification policies in Keycloak's handling of JWE-encrypted request objects, leading to unauthorized claims submission and compromise of data integrity in the OIDC authorization flow. However, the redirect URI allowlist mitigates the risk of full authorization code or token exfiltration. There is no impact on confidentiality or availability reported. The flaw violates OIDC Core and FAPI signing requirements, potentially affecting compliance and trustworthiness of authentication flows.

Currently, Red Hat does not offer an official fix or patch for this vulnerability. The available mitigation is the redirect URI allowlist, which acts as a compensating control to prevent full authorization code or token exfiltration. Red Hat states that other mitigation options do not meet their criteria for ease of use, applicability, or stability. Users should monitor the Red Hat advisory page for any future updates or patches and consider applying compensating controls such as strict redirect URI allowlists.