Vulnerability in Keycloak (CVE-2026-9793) - Impact and Remediation in DevTest Solutions

Products

• Service Virtualization

Issue/Introduction

A security vulnerability was identified in Keycloak (CVE-2026-9793). When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, effectively bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, compromising data integrity within the OpenID Connect (OIDC) authorization flow.

• CVE-ID: CVE-2026-9793
• CVSS Score: 5.9
• Vulnerability Type: Bypass of OIDC/FAPI signing requirements

Environment

Product: Service Virtualization (DevTest) 

Component: Keycloak Integration

Cause

The issue stems from Keycloak's processing logic for JWE encrypted request objects, which fails to enforce signature policies when the decrypted content is in a raw JSON format.

Resolution

This vulnerability is addressed in DevTest version 10.9.3.

Users running affected versions of DevTest should plan to upgrade to version 10.9.3 or later once it becomes available to ensure the Keycloak vulnerability is remediated.

Additional Information:

• While a redirect URI allowlist may act as a compensating control, it does not fully mitigate the risk of violating OIDC Core and FAPI signing requirements. Upgrading to the patched version is the recommended course of action.
• For further details, please refer to the official Keycloak security advisories regarding this CVE.