CVE-2026-79652

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak (affected versions not specified)

Description A flaw exists in the JWT Bearer authorization grant implementation within the keycloak-services component, which manages OAuth2 and OpenID Connect grant types for access token issuance. The system fails to verify if a client requires user consent before issuing a token. Consequently, an authenticated attacker possessing valid client credentials and a trusted identity provider assertion can bypass consent requirements to gain unauthorized access to user accounts at consent-gated clients.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.