The vulnerability in Keycloak involves improper access control related to the JWT authorization grant preview feature. When enabled, Keycloak fails to check if a user account is disabled during the processing of JWT authorization grants. This allows an attacker with low privileges to present a valid assertion token from an external identity provider and obtain a JWT for a disabled user, bypassing the disabled status and gaining unauthorized access.

An attacker with low privileges can exploit this vulnerability to obtain JWTs for disabled user accounts, leading to unauthorized access to sensitive resources. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly state the availability of a patch or workaround. Until an official fix is released, consider disabling the JWT authorization grant preview feature if possible to mitigate risk.