Keycloak contains a JWT algorithm confusion vulnerability that undermines signature verification when an attacker generates a forged JWT assertion. By exploiting this flaw, an entity in possession of valid client credentials can obtain unauthorized access tokens that reference any federated user linked to the affected identity provider. The resulting impersonation allows the attacker to access protected resources and potentially elevate privileges within the Keycloak realm.

Red Hat Build of Keycloak, including the 26.6 and 26.6.4 releases, is impacted. Affected environments also include Red Hat Data Grid 8, the Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. These components are distributed under the Red Hat Build of Keycloak package across several Red Hat platforms.

With a CVSS v3 score of 8.1, the vulnerability presents a high‑severity risk. Although no EPSS value is currently available, the likelihood of exploitation remains significant, especially for attackers who can compromise or acquire a client with valid credentials. The flaw is not yet listed in CISA KEV, but the potential for impersonation and privilege escalation makes it urgent to remediate. The attack path requires access to a client that can use the JWT Authorization Grant, but once the attacker obtains such credentials, the algorithm confusion allows the generation of undetectable, full access to any federated user.