Keycloak Disabled Identity Provider JWT Authorization Grant Vulnerability

A vulnerability exists in Keycloak's JWT authorization grant flow. The server does not verify if an Identity Provider (IdP) is enabled before issuing tokens. This flaw allows an entity with access to a disabled IdP's signing key to generate valid JWT assertions, which Keycloak accepts, resulting in unauthorized access tokens. This issue affects Red Hat build of Keycloak 26.4.9.

Impact

Exploitation of this vulnerability allows for unauthorized issuance of access tokens, bypassing security controls and potentially leading to unauthorized access to resources or actions within the application.

Remediation

Administrators should revoke or rotate the signing keys associated with any disabled Identity Provider in Keycloak to prevent unauthorized token issuance. Red Hat build of Keycloak 26.4.9 is available as a standalone server, as well as an integrated solution for OpenShift Container Platform.