CVE-2026-9793

[CVE catalog]

Severity

Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Published

May 27, 2026, 10:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.16% · Oct 25, 2026

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements. keycloak: Keycloak: Security policy bypass in JWE-encrypted request object processing This Medium impact vulnerability in Keycloak allows an attacker to bypass the `requestObjectSignatureAlg` policy when processing JWE-encrypted request objects with raw JSON plaintext. While this violates OIDC Core and FAPI signing requirements, the `redirect_uri` allowlist acts as a compensating control, preventing full authorization code or token exfiltration. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.