CVE-2026-1609

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.

• CWE-284
• CWE-284

• https://access.redhat.com/security/cve/CVE-2026-1609Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2435257Issue Tracking, Vendor Advisory
• https://github.com/keycloak/keycloak/issues/46144Issue Tracking
• https://github.com/keycloak/keycloak/releases/tag/26.5.3Release Notes
• https://access.redhat.com/security/cve/CVE-2026-1609Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2435257Issue Tracking, Vendor Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1609.jsonVendor Advisory

Published

Jul 16, 2026

Last Modified

Aug 9, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-16083A security flaw has been discovered in Sipeed PicoClaw up to…5.5
• CVE-2026-16084A weakness has been identified in Sipeed PicoClaw up to 0.2.…7.3
• CVE-2026-16085A security vulnerability has been detected in Sipeed PicoCla…5.3
• CVE-2026-16087The Icegram Engage – Popups, Optins, CTAs & Lead Generation …6.5
• CVE-2026-16088A vulnerability was detected in halo-dev halo up to 2.24.2. …4.7
• CVE-2026-16089A flaw was found in the keycloak-services component of Red H…5.9
• CVE-2026-16090The GamiPress – Gamification plugin to reward points, achiev…6.4
• CVE-2026-16091The GamiPress – Gamification plugin to reward points, achiev…6.4
• CVE-2026-16092The Improved Save Button plugin for WordPress is vulnerable …6.5
• CVE-2026-16093Keycloak provides a mechanism called Client Policies to enfo…5.4
• CVE-2026-16094The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative fo…4.9
• CVE-2026-16095A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Bu…8.8