CVE-2026-11800: Authentication Bypass via JWT Algorithm Confusion in Keycloak

Vulnerability ID: CVE-2026-11800
CVSS Score: 8.1
Published: 2026-11-03

A cryptographic signature verification flaw in Keycloak's OAuth 2.0 JWT Authorization Grant flow (RFC 7523) and federated client authentication mechanisms allows algorithm confusion between asymmetric and symmetric signing algorithms. Authenticated clients can sign forged JWT assertions using HMAC-SHA256 (HS256) with an Identity Provider's public key bytes acting as the symmetric secret. Keycloak processes the public key material as an HMAC secret key, validating the forged assertion and issuing unauthorized access tokens for federated users.

TL;DR

Keycloak versions 26.6.0 through 26.6.3 are vulnerable to JWT algorithm confusion (CWE-347) in the JWT Authorization Grant flow and federated client authentication. An attacker with valid client credentials can forge identity assertions by signing them with HS256 using a target Identity Provider's public key as the shared secret, leading to authentication bypass and user impersonation.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-347: Improper Verification of Cryptographic Signature
• CVSS v3.1 Score: 8.1 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
• Attack Vector: Network (OAuth 2.0 Token Endpoint)
• EPSS Score: 0.30% (22.83rd Percentile)
• Primary Impact: Authentication Bypass & Federated User Impersonation
• Exploit Status: Proof-of-Concept (Upstream Integration Test)
• CISA KEV Status: Not Listed
• Patched Version: Keycloak 26.6.4

Affected Systems

• Keycloak
• Red Hat build of Keycloak (RHBK)
• Keycloak: >= 26.6.0, < 26.6.4 (Fixed in: 26.6.4)
• rhbk/keycloak-rhel9: < 26.6-8 (Fixed in: 26.6-8)
• rhbk/keycloak-operator-bundle: < 26.6.4-2 (Fixed in: 26.6.4-2)
• rhbk/keycloak-rhel9-operator: < 26.6-8 (Fixed in: 26.6-8)

Code Analysis

Commit: 6d61885

CVE-2026-11800 Remove support for symmetric algorithms in JWT public key validators (26.6)

@@ -129,15 +130,36 @@ public boolean validateTokenAudience(List<String> expectedAudiences, boolean mul
         return true;
     }

+    /**
+     * By default, symmetric algorithms are not allowed
+     * @return false by default
+     */
+    protected boolean isSymmetricAlgorithmAllowed() {
+        return false;
+    }
+
     public boolean validateSignatureAlgorithm(String expectedSignatureAlg) {
         JWSInput jws = clientAssertionState.getJws();

         if (jws.getHeader().getAlgorithm() == null) {
             return failure("Invalid signature algorithm");
         }

+        String algorithmName = jws.getHeader().getAlgorithm().name();
+
+        if ("none".equalsIgnoreCase(algorithmName)) {
+            return failure("Invalid signature algorithm");
+        }
+
+        if (!isSymmetricAlgorithmAllowed()) {
+            ClientSignatureVerifierProvider signatureProvider = session.getProvider(ClientSignatureVerifierProvider.class, algorithmName);
+            if (signatureProvider == null || !signatureProvider.isAsymmetricAlgorithm()) {
+                return failure("Invalid signature algorithm");
+            }
+        }
+
         if (expectedSignatureAlg != null) {
-            if (!expectedSignatureAlg.equals(jws.getHeader().getAlgorithm().name())) {
+            if (!expectedSignatureAlg.equals(algorithmName)) {
                 return failure("Invalid signature algorithm");
             }
         }

Commit: d343c73

Remove support for symmetric algorithms in JWT public key validators

@@ -29,35 +27,40 @@ public class HardcodedPublicKeyLoader implements PublicKeyLoader {
             kw.setKid(kid);
             kw.setUse(KeyUse.SIG);
             kw.setAlgorithm(algorithm);
             if (JavaAlgorithm.isRSAJavaAlgorithm(algorithm)) {
                 kw.setType(KeyType.RSA);
                 kw.setPublicKey(PemUtils.decodePublicKey(encodedKey, KeyType.RSA));
             } else if (JavaAlgorithm.isECJavaAlgorithm(algorithm)) {
                 kw.setType(KeyType.EC);
                 kw.setPublicKey(PemUtils.decodePublicKey(encodedKey, KeyType.EC));
             } else if (JavaAlgorithm.isEddsaJavaAlgorithm(algorithm)) {
                 kw.setType(KeyType.OKP);
                 kw.setPublicKey(PemUtils.decodePublicKey(encodedKey, Algorithm.EdDSA));
                 kw.setCurve(kw.getPublicKey().getAlgorithm());
-            } else if (JavaAlgorithm.isHMACJavaAlgorithm(algorithm)) {
-                kw.setType(KeyType.OCT);
-                kw.setSecretKey(KeyUtils.loadSecretKey(Base64Url.decode(encodedKey), algorithm));
+            } else {
+                logger.warnf("Unrecognized or invalid algorithm %s for hardcoded public key", algorithm);
+                kw = null;
             }
             keyWrapper = kw;

Exploit Details

• GitHub (Keycloak Integration Test Suite): Upstream patch commit containing integration test testHS256AlgorithmConfusion demonstrating JWT assertion forgery using HMAC-SHA256 with an Identity Provider's encoded public key.

Mitigation Strategies

• Upgrade Keycloak instances to version 26.6.4 or later to enforce asymmetric algorithm validation on public key verifiers.
• Explicitly pin expected asymmetric signature algorithms (e.g., RS256, ES256, EdDSA) in Identity Provider and Client assertion configurations.
• Audit and restrict OAuth clients permitted to execute the JWT Authorization Grant flow (urn:ietf:params:oauth:grant-type:jwt-bearer).
• Rotate client secrets for any semi-trusted clients where credential compromise is suspected.

Remediation Steps:

1. Identify all Keycloak deployments running versions >= 26.6.0 and < 26.6.4.
2. For upstream installations, download and deploy Keycloak 26.6.4.
3. For Red Hat build of Keycloak 26.6 deployments, apply errata RHSA-2026:30083 and RHSA-2026:30084 (upgrade container images to 26.6-8 and operator bundle to 26.6.4-2).
4. Verify Identity Provider JWT Authorization Grant settings in the Admin Console to ensure expected signature algorithms are explicitly configured to asymmetric primitives.

References

• NVD Vulnerability Detail: CVE-2026-11800
• CVE.org Record: CVE-2026-11800
• Red Hat CVE Advisory: CVE-2026-11800
• Red Hat Security Advisory (RHSA-2026:30083)
• Red Hat Security Advisory (RHSA-2026:30084)
• Red Hat Bugzilla Issue 2487006
• Red Hat CSAF VEX JSON
• Upstream Keycloak Commit 6d61885f20ac59a2ff8b823fc9ed1f1ef1019951
• Upstream Keycloak Commit d343c7373dcc7bfeb9dc14de2309836299c81837
• Upstream Keycloak Pull Request 50374
• Upstream Keycloak Release 26.6.4

Read the full report for CVE-2026-11800 on our website for more details including interactive diagrams and full exploit analysis.