The flaw in the JWT Authorization Grant of the keycloak‑services component allows an authenticated client to bypass login restrictions set by an OIDC or Google identity provider. When claim filtering or similar restrictions are configured, standard browser logins enforce those checks, but the JWT flow skips them. As a result, the attacker can obtain an access token for a user who would otherwise be blocked by the identity provider’s claims, effectively granting the attacker the privileges of that user.

Affects Red Hat Build of Keycloak and Red Hat Single Sign‑On 7. Because the advisory does not list specific versions, any installation of these products that uses the JWT Authorization Grant should assess whether the flow is enabled and whether claim filtering is required.

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in KEV, suggesting no widespread exploitation has been observed. The attack requires an authenticated client and a configuration that uses claim filtering; it is therefore limited to environments where the JWT grant is enabled and clients are not tightly restricted. In systems with open client registration or reliance on the JWT grant for privileged operations, the risk is higher and immediate remediation is recommended.