CVE-2026-11800High· 8.1▾ TwilightKeycloak has authentication bypass via jwt algorithm confusion
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.
org.keycloak:keycloak-services < 26.6.4Upgrade to a patched release:
org.keycloak:keycloak-services 26.6.4Connected by shared product, vendor, weakness, or advisory.
GHSA-gqj5-2xp5-3qmpHigh· 8.1Duplicate Advisory: Authentication bypass via jwt algorithm confusion
CVE-2026-9799Medium· 4.6Keycloak allows unauthorized access to resources via uma permission ticket bypass
GHSA-7pm9-g8jh-3m74Medium· 4.9Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
CVE-2026-9083Medium· 4.9Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
CVE-2026-9086High· 7.3Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
GHSA-37j9-56gh-j2r7High· 7.3Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass