A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.
Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.
A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.
Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP's signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.
Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.
Reported by CVE List V5 (cvelist).
HOL Guard can help your team monitor supply-chain activity while the upstream record is clarified.
Explore HOL GuardReported by CVE List V5 (cvelist).
HOL Guard can help your team monitor supply-chain activity while the upstream record is clarified.
Explore HOL Guard