CVE-2026-117627

The record

A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component. When an OIDC or Google identity provider is configured with specific login restrictions, such as claim filtering, these checks are correctly applied during standard browser logins but are skipped during the JWT-based grant flow. This allows an authenticated client to obtain access tokens for a user even if their identity provider claims should have blocked the login.

Affected packages

Related vulnerabilities

• CVE-2026-55147 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
• CVE-2026-55146 LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application… CWE-862
• CVE-2026-62967 ZTNET is a ZeroTier web UI for private controllers with multiuser and organization… CWE-862
• CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. CWE-862
• CVE-2026-78403 Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel… CWE-862
• CVE-2026-62301 MyTube is a self-hosted downloader and player for several video websites. CWE-862
• CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. CWE-862
• CVE-2026-116245 libpq looks a connection service up in the service file of the operating-system account… CWE-862