AIKIDO-2026-271447

TL;DR

keycloak-services validates JWT assertions in the JWT Authorization Grant flow and related JWT public-key client authenticators without restricting the signature to asymmetric algorithms. A client holding valid credentials can forge an assertion signed with a symmetric algorithm such as HS256, causing the server to verify the signature using known public key material as the HMAC secret. This algorithm confusion bypasses signature verification and lets the caller mint access tokens that impersonate any federated user linked to the affected identity provider. The fix rejects symmetric algorithms in the public-key JWT validators and only permits them for the dedicated client-secret-jwt authentication flow.