{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11800.json" } ], "title": "org.keycloak:keycloak-services: Keycloak: Authentication bypass via JWT algorithm confusion", "tracking": { "current_release_date": "2026-06-30T04:13:53+00:00", "generator": { "date": "2026-06-30T04:13:53+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.0" } }, "id": "CVE-2026-11800", "initial_release_date": "2026-05-29T00:00:00+00:00", "revision_history": [ { "date": "2026-05-29T00:00:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-06-26T09:47:21+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-06-30T04:13:53+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Build of Keycloak", "product": { "name": "Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:" } } } ], "category": "product_family", "name": "Red Hat Build of Keycloak" }, { "branches": [ { "category": "product_name", "name": "Red Hat Data Grid 8", "product": { "name": "Red Hat Data Grid 8", "product_id": "red_hat_data_grid_8", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_data_grid:8" } } } ], "category": "product_family", "name": "Red Hat Data Grid 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product": { "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack", "product_identification_helper": { "cpe": "cpe:/a:redhat:jbosseapxp" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack" }, { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7", "product": { "name": "Red Hat Single Sign-On 7", "product_id": "red_hat_single_sign-on_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Keycloak 26.6", "product": { "name": "Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:26.6::el9" } } }, { "category": "product_name", "name": "Red Hat build of Keycloak 26.6.4", "product": { "name": "Red Hat build of Keycloak 26.6.4", "product_id": "Red Hat build of Keycloak 26.6.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:26.6::el9" } } } ], "category": "product_family", "name": "Red Hat build of Keycloak" }, { "category": "product_version", "name": "rhbk/keycloak-rhel9", "product": { "name": "rhbk/keycloak-rhel9", "product_id": "rhbk/keycloak-rhel9", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9?repository_url=registry.redhat.io/rhbk/keycloak-rhel9" } } }, { "category": "product_version", "name": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "product": { "name": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "product_id": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "product_identification_helper": { "purl": "pkg:oci/rhbk-openshift-rhel9?repository_url=registry.redhat.io/rhbk-openshift-rhel9" } } }, { "category": "product_version", "name": "keycloak-services", "product": { "name": "keycloak-services", "product_id": "keycloak-services", "product_identification_helper": { "purl": "pkg:maven/org.keycloak/keycloak-services" } } }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x", "product": { "name": "rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x", "product_id": "rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e?arch=s390x&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.6-8" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x", "product_id": "rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94?arch=s390x&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.6-8" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le", "product": { "name": "rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le", "product_id": "rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11?arch=ppc64le&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.6-8" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le", "product_id": "rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed?arch=ppc64le&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.6-8" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64", "product": { "name": "rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64", "product_id": "rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.6-8" } } }, { "category": "product_version", "name": "rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64", "product": { "name": "rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64", "product_id": "rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-operator-bundle&tag=26.6.4-2" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64", "product_id": "rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926?arch=amd64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.6-8" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64", "product": { "name": "rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64", "product_id": "rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3?arch=arm64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9&tag=26.6-8" } } }, { "category": "product_version", "name": "rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64", "product": { "name": "rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64", "product_id": "rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64", "product_identification_helper": { "purl": "pkg:oci/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592?arch=arm64&repository_url=registry.redhat.io/rhbk/keycloak-rhel9-operator&tag=26.6-8" } } } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64 as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64" }, "product_reference": "rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64 as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64 as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le" }, "product_reference": "rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le" }, "product_reference": "rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64 as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64" }, "product_reference": "rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x" }, "product_reference": "rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64 as a component of Red Hat build of Keycloak 26.6", "product_id": "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64" }, "product_reference": "rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64", "relates_to_product_reference": "9Base-RHBK-26.6" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk-openshift-rhel9/rhbk-openshift-rhel9 as a component of Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak:rhbk-openshift-rhel9/rhbk-openshift-rhel9" }, "product_reference": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "relates_to_product_reference": "red_hat_build_of_keycloak" }, { "category": "default_component_of", "full_product_name": { "name": "rhbk/keycloak-rhel9 as a component of Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak:rhbk/keycloak-rhel9" }, "product_reference": "rhbk/keycloak-rhel9", "relates_to_product_reference": "red_hat_build_of_keycloak" }, { "category": "default_component_of", "full_product_name": { "name": "keycloak-services as a component of Red Hat Data Grid 8", "product_id": "red_hat_data_grid_8:keycloak-services" }, "product_reference": "keycloak-services", "relates_to_product_reference": "red_hat_data_grid_8" }, { "category": "default_component_of", "full_product_name": { "name": "keycloak-services as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services" }, "product_reference": "keycloak-services", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "keycloak-services as a component of Red Hat Single Sign-On 7", "product_id": "red_hat_single_sign-on_7:keycloak-services" }, "product_reference": "keycloak-services", "relates_to_product_reference": "red_hat_single_sign-on_7" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Bilal Teke" ] } ], "cve": "CVE-2026-11800", "cwe": { "id": "CWE-347", "name": "Improper Verification of Cryptographic Signature" }, "discovery_date": "2026-06-09T05:06:35.697000+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "red_hat_build_of_keycloak:rhbk-openshift-rhel9/rhbk-openshift-rhel9", "red_hat_data_grid_8:keycloak-services", "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services", "red_hat_single_sign-on_7:keycloak-services" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2487006" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.", "title": "Vulnerability description" }, { "category": "summary", "text": "org.keycloak:keycloak-services: Keycloak: Authentication bypass via JWT algorithm confusion", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64", "Red Hat build of Keycloak 26.6.4" ], "known_affected": [ "red_hat_build_of_keycloak:rhbk/keycloak-rhel9" ], "known_not_affected": [ "red_hat_build_of_keycloak:rhbk-openshift-rhel9/rhbk-openshift-rhel9", "red_hat_data_grid_8:keycloak-services", "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services", "red_hat_single_sign-on_7:keycloak-services" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-11800" }, { "category": "external", "summary": "RHBZ#2487006", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487006" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11800", "url": "https://www.cve.org/CVERecord?id=CVE-2026-11800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11800" } ], "release_date": "2026-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2026-06-25T18:50:57+00:00", "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.", "product_ids": [ "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64" ], "url": "https://access.redhat.com/errata/RHSA-2026:30084" }, { "category": "vendor_fix", "date": "2026-06-25T18:47:39+00:00", "details": "Before applying the update, back up your existing installation,\nincluding all applications, configuration files, databases and\ndatabase settings, and so on.", "product_ids": [ "Red Hat build of Keycloak 26.6.4" ], "url": "https://access.redhat.com/errata/RHSA-2026:30083" }, { "category": "none_available", "details": "Affected", "product_ids": [ "red_hat_build_of_keycloak:rhbk/keycloak-rhel9" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64", "Red Hat build of Keycloak 26.6.4", "red_hat_build_of_keycloak:rhbk-openshift-rhel9/rhbk-openshift-rhel9", "red_hat_build_of_keycloak:rhbk/keycloak-rhel9", "red_hat_data_grid_8:keycloak-services", "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services", "red_hat_single_sign-on_7:keycloak-services" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "9Base-RHBK-26.6:rhbk/keycloak-operator-bundle@sha256:8e800f8ab196c4bbbaf4397e438a2e02e7dc9fd588feb6a6a813f730ab65b0ec_amd64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:2e00190cd88d026765df408d00a63cee8ceb3cd27ddb43e41b37c85936f4e926_amd64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:c88a14bcd41b509c2f10713403d6a3cde9a9d2e6f78311de43a9b3090f7fcb94_s390x", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:d14691fa2b04762df8e788c63104611b75714f671604347347afb7f27ec6e592_arm64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9-operator@sha256:e0ff01fb6339ac11a495514a23a71a78bd947809fa0c9bc1a3bda7cdb59bc9ed_ppc64le", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:20440d38f4f71719a27184eeb8eca059dd39fa6c975dfa57529af586bbe7db11_ppc64le", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:4c7d38f4d628edcb59a1f066487f60c3874633d29c9aa0aaa5edd73ef0c5d9e3_arm64", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:df587be8cab83d8da4cbc7e9d4e6ffcaa5cd779027238d51ee462941a680142e_s390x", "9Base-RHBK-26.6:rhbk/keycloak-rhel9@sha256:ffedd9c68012f3ce5e6d3287775c589fcbe5ba6858afc6b2fd47663fce4b138b_amd64", "Red Hat build of Keycloak 26.6.4", "red_hat_build_of_keycloak:rhbk-openshift-rhel9/rhbk-openshift-rhel9", "red_hat_build_of_keycloak:rhbk/keycloak-rhel9", "red_hat_data_grid_8:keycloak-services", "red_hat_jboss_enterprise_application_platform_expansion_pack:keycloak-services", "red_hat_single_sign-on_7:keycloak-services" ] } ], "title": "org.keycloak:keycloak-services: Keycloak: Authentication bypass via JWT algorithm confusion" } ] }