Keycloak JWE Request Object Processing Vulnerability Bypassing Signature Policy

A vulnerability exists in Keycloak's handling of JSON Web Encryption (JWE) encrypted request objects. When the decrypted content is raw JSON, Keycloak may improperly process unsigned claims, ignoring the established signature policy. This flaw enables remote attackers to introduce unauthorized claims, jeopardizing data integrity in the OpenID Connect (OIDC) authorization process. Although a redirect URI allowlist provides some mitigation, this issue contravenes OIDC Core and Financial-grade API (FAPI) signing standards.

Impact

Exploiting this vulnerability allows attackers to bypass the request object signature algorithm policy, potentially leading to unauthorized claims being processed in the OIDC authorization flow. This manipulation of claims can disrupt the integrity of the authorization process, although the redirect URI allowlist may prevent complete exfiltration of authorization codes or tokens.