CVE-2026-79652

Vendor solution

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Red Hat statement

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific non-default client configuration and the possession of valid client credentials and a trusted IdP assertion. Successful exploitation allows an attacker to bypass user consent requirements and obtain an access token for a target user. The vulnerability's root cause is a missing authorization check in the JWT Bearer grant implementation that fails to honor the consentRequired configuration flag.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.