6.5
Medium
CVE-2026-37979 A flaw was found in Keycloak
Description
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-17 | 26.4-17 |
| Red Hat build of Keycloak 26.4.12 | Versions not published |
References
- RHSA-2026:19596 access.redhat.com
- RHSA-2026:19597 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2455328 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Build of Keycloak
The 266 CVEs of Red Hat Build of Keycloak →
CVE-2026-97847
Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
7.1
High
CVE-2026-97175
Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
8.8
High
CVE-2026-97174
Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
6.8
Medium
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
High