A flaw in Keycloak allows the JWE‑encrypted request object to be processed incorrectly when the decrypted payload is raw JSON. In this situation the system may treat unsigned claims as if they were signed, thereby bypassing the configured signature policy for OIDC request objects. This flaw enables a remote attacker to inject unauthorized claims into the authorization flow, compromising the integrity of the data exchanged during authentication and authorization.

The vulnerability affects Red Hat Build of Keycloak. No specific version ranges are listed in the current data.

The CVSS score of 5.9 suggests a moderate risk. The EPSS score is unavailable and the vulnerability has not been listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote over HTTPS request to the Keycloak server; an attacker can craft a JWE request object with unsigned claims and submit it to the authorization endpoint. Compromise is limited to data integrity within the OIDC flow and does not expose credentials or allow arbitrary code execution.