2026-08-31 · run 2026-08-31-fgap-v2-token-exchange

FGAP-v2 / token-exchange spot-check (26.7.3): activation surface changed

Condition: 26.7.2/26.7.3 advisory batch — FGAP-v2 RBAC fixes (CVE-2026-14613/16105/…) and token-exchange fixes (CVE-2026-18215/18214/…)

What was checked

Feature flags (serverinfo): ADMIN_FINE_GRAINED_AUTHZ_V2 enabled=true, ADMIN_FINE_GRAINED_AUTHZ enabled=false — v2 is the active line in 26.7.3.
Realm activation field: PUT /admin/realms/lab with adminFineGrainedAuthz:"v2" → HTTP 400 Unrecognized field "adminFineGrainedAuthz". The RealmRepresentation no longer carries this field in 26.7.3.
Permission-catalog endpoint: GET /admin/realms/lab/fine-grained-permissions and /admin-fine-grained-permissions both → HTTP 404 on the lab realm.

Symptom: the documented way to turn on FGAP v2 (set adminFineGrainedAuthz on the realm) is rejected as an unrecognized field, and the permission-catalog endpoint 404s even though the v2 feature flag reports enabled.
Additional evidence (2026-08-31): ADMIN_FINE_GRAINED_AUTHZ_V2 is type=DEFAULT, enabled=true (not a preview gate). 26.7.3's RealmRepresentation carries adminPermissionsEnabled and adminPermissionsClient but no adminFineGrainedAuthz. Enabling adminPermissionsEnabled=true on a realm does not expose any fine-grained-permissions/admin-fine-grained-permissions endpoint (still HTTP 404). The fgap REST resources exist in the jar (org.keycloak.services.resources.admin.fgap.*) but their registration path is no longer the documented one.
Cause: the realm-level toggle/endpoint was renamed/relocated in the 26.7.x FGAP-v2 rollout; pinning the exact @Path needs the 26.7.3 admin REST / upgrade notes or source.
Impact: an operator migrating to 26.7.x cannot activate or audit FGAP v2 with the pre-26.7 procedure. The CVE-by-CVE RBAC reproductions (role-groups bypass CVE-2026-14613, composite-endpoint authz CVE-2026-16105, default-group disclosure CVE-2026-16108, etc.) are blocked on re-establishing the activation procedure, which is now a first-class lab task rather than a quick flag flip.

CVE-2026-18215 / CVE-2026-18214 — Microsoft/Google token-exchange tenant/hosted-domain bypass. Needs a real (or mocked) external IdP; not reproducible in the Compose lab.
CVE-2026-16093 — signed-JWT assertion bypass with unsigned assertion headers. Needs a client-jwt client + keypair harness.
CVE-2026-79652 — jwt-bearer grant consentRequired enforcement.