CVE-2026-9793

The record

A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leading to a compromise of data integrity within the OpenID Connect (OIDC) authorization flow. While a redirect URI allowlist acts as a compensating control, this vulnerability violates OIDC Core and Financial-grade API (FAPI) signing requirements.

Affected packages

Related vulnerabilities

• CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO… CWE-347
• CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment… CWE-347
• CVE-2026-102271 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
• CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
• CVE-2026-102273 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
• CVE-2026-102268 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
• CVE-2026-102266 PyJWT is a Python implementation of JSON Web Token standards. CWE-347
• CVE-2026-73784 A potential security vulnerability in HPE IceWall products could be exploited to tamper… CWE-347