Skip to content

Fix JWE request object signature bypass (26.4) - #51041

Merged
stianst merged 1 commit into
keycloak:release/26.4from
graziang:backport-50565-26.4
Jul 20, 2026
Merged

Fix JWE request object signature bypass (26.4)#51041
stianst merged 1 commit into
keycloak:release/26.4from
graziang:backport-50565-26.4

Conversation

@graziang

@graziang graziang commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Closes #49429

Signed-off-by: Giuseppe Graziano g.graziano94@gmail.com
(cherry picked from commit 959a48d)

@graziang
graziang requested review from a team as code owners July 20, 2026 14:17
@graziang graziang changed the title Fix JWE request object signature bypass (#50565) Fix JWE request object signature bypass (26.4) Jul 20, 2026
@graziang
Fix JWE request object signature bypass (keycloak#50565)
ffd12f3 
Closes keycloak#49429

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
(cherry picked from commit 959a48d)
@graziang
graziang force-pushed the backport-50565-26.4 branch from 5fac259 to ffd12f3 Compare July 20, 2026 15:19
@mposolda mposolda self-assigned this Jul 20, 2026
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 20, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 20, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test13_registrationWithDefaultGroupsAndDeferredLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test13_registrationWithDefaultGroupsAndDeferredLdapCreation(LDAPGroupMapperTest.java:1080)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest#test14_registrationWithDefaultGroupsAndImmediateLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test14_registrationWithDefaultGroupsAndImmediateLdapCreation(LDAPGroupMapperTest.java:1089)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.noimport.LDAPGroupMapperNoImportTest#test13_registrationWithDefaultGroupsAndDeferredLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test13_registrationWithDefaultGroupsAndDeferredLdapCreation(LDAPGroupMapperTest.java:1080)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.noimport.LDAPGroupMapperNoImportTest#test14_registrationWithDefaultGroupsAndImmediateLdapCreation

Keycloak CI - Base IT (5)

org.keycloak.testsuite.runonserver.RunOnServerException: java.lang.NullPointerException
	at org.keycloak.testsuite.client.KeycloakTestingClient$Server.run(KeycloakTestingClient.java:201)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.configureGroupMapperAndRegistration(LDAPGroupMapperTest.java:1096)
	at org.keycloak.testsuite.federation.ldap.LDAPGroupMapperTest.test14_registrationWithDefaultGroupsAndImmediateLdapCreation(LDAPGroupMapperTest.java:1089)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
...

Report flaky test

org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP

Keycloak CI - Java Distribution IT (windows-latest - temurin - 25)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '25.0.3'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

@stianst
stianst merged commit f172a0d into keycloak:release/26.4 Jul 20, 2026
77 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@stianst stianst stianst approved these changes
+1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@mposolda mposolda

Labels

flaky-test team/core-protocols

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@graziang @stianst @mposolda