---
id: CVE-2026-117627
title: >-
  Keycloak-services: keycloak-services: jwt authorization grant bypasses
  identity provider login restrictions
summary: >-
  A flaw was found in the JWT Authorization Grant implementation of the
  keycloak-services component. When an OIDC or Google identity provider is
  configured with specific login restrictions, such as claim filtering, these
  checks are correct…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Red Hat
product: keycloak-services
affected:
  - keycloak-services (all versions)
  - rhbk/keycloak-rhel9 (all versions)
  - keycloak-services
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T06:22:03.427Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117627'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-117627'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2561959'
    label: RHBZ#2561959
tags:
  - cve.org
epss: 0.00246
epssPercentile: 0.15998
ingestedAt: '2026-10-31T04:17:25.419Z'
---

## Overview

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

## Affected

- `keycloak-services (all versions)`
- `rhbk/keycloak-rhel9 (all versions)`
- `keycloak-services`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.