CVE-2026-11800

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A JWT algorithm confusion flaw exists in the JWT Authorization Grant flow. An attacker possessing valid client credentials can bypass signature verification by forging an assertion. This allows the creation of unauthorized access tokens, enabling the attacker to impersonate any federated user linked to the affected Identity Provider, which can lead to unauthorized access and privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.