Skip to content

Fix JWE request object signature bypass - #50565

Merged
pskopek merged 1 commit into
keycloak:mainfrom
graziang:issue-49429
Jul 14, 2026
Merged

Fix JWE request object signature bypass#50565
pskopek merged 1 commit into
keycloak:mainfrom
graziang:issue-49429

Conversation

@graziang

@graziang graziang commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Closes #49429

Closes keycloak#49429

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
@graziang
graziang marked this pull request as ready for review July 2, 2026 12:11
@graziang
graziang requested review from a team as code owners July 2, 2026 12:11
Copilot AI review requested due to automatic review settings July 2, 2026 12:11
@graziang
graziang requested review from a team as code owners July 2, 2026 12:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses CVE-2026-9793 by ensuring that when a client requires signed OIDC request objects, a JWE-encrypted request object whose decrypted payload is raw JSON (not a nested signed JWS) is rejected, and adds an integration test to cover the bypass scenario.

Changes:

  • Enforce rejection of decrypted JWE payloads that are not a signed JWS when requestObjectSignatureAlg is configured.
  • Add an integration test that submits a JWE-wrapped unsigned JSON request object and asserts the request is rejected.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
services/src/main/java/org/keycloak/jose/jws/DefaultTokenManager.java Adds enforcement when JWE plaintext is not a JWS and the client requires request-object signatures.
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oidc/OIDCAdvancedRequestParamsTest.java Adds a regression test for rejecting JWE-wrapped unsigned JSON request objects when signatures are required.

Comment on lines 155 to 165
try {
JOSE jws = JOSEParser.parse(new String(content));

if (jws instanceof JWSInput) {
jwtValidator.accept(jws, client);
return verifyJWS(client, clazz, (JWSInput) jws, allowNoneAlgorithm);
}
} catch (Exception ignore) {
// try to decrypt content as is
} catch (Exception e) {
logger.debug("Decrypted JWE content is not a valid JWS", e);
rejectUnsignedContentIfSignatureRequired(client);
}
Comment on lines +1587 to +1592
KeysMetadataRepresentation.KeyMetadataRepresentation encKey = KeyUtils
.findActiveEncryptingKey(managedRealm.admin(), Algorithm.PS256);
PublicKey encryptionKey = keysForUse.get(encKey.getKid());

JWE jwe = new JWE().header(new JWEHeader(RSA_OAEP, JWEConstants.A256GCM, null)).content(contentBytes);
jwe.getKeyStorage().setEncryptionKey(encryptionKey);

@jimmychakkalakal jimmychakkalakal left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @graziang for PR. Look good to me, I approve the PR

@pskopek
pskopek merged commit 959a48d into keycloak:main Jul 14, 2026
89 checks passed
graziang added a commit to graziang/keycloak that referenced this pull request Jul 14, 2026
Closes keycloak#49429

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
(cherry picked from commit 959a48d)
graziang added a commit to graziang/keycloak that referenced this pull request Jul 15, 2026
Closes keycloak#49429

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
(cherry picked from commit 959a48d)
pskopek pushed a commit that referenced this pull request Jul 15, 2026
Closes #49429


(cherry picked from commit 959a48d)

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
pskopek pushed a commit that referenced this pull request Jul 15, 2026
Closes #49429


(cherry picked from commit 959a48d)

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
graziang added a commit to graziang/keycloak that referenced this pull request Jul 20, 2026
Closes keycloak#49429

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
(cherry picked from commit 959a48d)
stianst pushed a commit that referenced this pull request Jul 20, 2026
Closes #49429


(cherry picked from commit 959a48d)

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement

4 participants