CVE-2026-37979
published 2026-05-19CVE-2026-37979: A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client…
PriorityP343medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.41%
34.7th percentile
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | build_of_keycloak | >= 26.4 < 26.4.12 | 26.4.12 |
| rhbk | keycloak-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4x37-hw65-52w8: A flaw was found in Keycloak
ghsa_unreviewed·2026-05-19
CVE-2026-37979 [MEDIUM] CWE-284 GHSA-4x37-hw65-52w8: A flaw was found in Keycloak
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
GHSA
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
ghsa·2026-05-19
CVE-2026-37979 [MEDIUM] CWE-284 Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
Red Hat
keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
vendor_redhat·2026-05-19·CVSS 6.5
CVE-2026-37979 [MEDIUM] keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
Statement: Moderate impact: Keycloak's OIDC token introspection endpoint fails to enforce audience validation, allowing a confidential client to retrieve sensitive token claims intended for a different audience. This com
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-105306 keycloak-services: keycloak-services: Token introspection audience bypass via Dynamic Client Registration
bugzilla·2026-10-05·CVSS 6.5
CVE-2026-105306 [MEDIUM] CVE-2026-105306 keycloak-services: keycloak-services: Token introspection audience bypass via Dynamic Client Registration
CVE-2026-105306 keycloak-services: keycloak-services: Token introspection audience bypass via Dynamic Client Registration
A vulnerability was found in Keycloak where the Dynamic Client Registration (DCR) flow does not properly filter sensitive client attributes. Specifically, a registrant using an Initial Access Token can set the internal attribute allow.token.introspection.without.audience.check during the registration process. This attribute disables the mandatory audience verification on the token introspection endpoint.
To exploit this flaw, an attacker must possess a valid Initial Access Token for a realm where DCR is enabled. By registering a malicious client with this attribute, the attacker can then use that client's credentials to introspect any active access token they have obta
Bugzilla
CVE-2026-18208 keycloak-services: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim
bugzilla·2026-07-29·CVSS 6.5
CVE-2026-18208 [MEDIUM] CVE-2026-18208 keycloak-services: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim
CVE-2026-18208 keycloak-services: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim
An information disclosure vulnerability was identified in Keycloaks OIDC token introspection endpoint. This flaw is an incomplete fix for CVE-2026-37979. While the original fix correctly enforced audience checks by marking out-of-audience tokens as inactive, it failed to sanitize the jwt field in the response when JWT introspection responses are enabled.
The vulnerability exists in the keycloak-services component. When a confidential client with the client.introspection.response.allow.jwt.claim.enabled attribute set to true requests an application/jwt response, the server includes a signed JWT representation of the token even if the audience check fails.
An attacker who
Bugzilla
CVE-2026-37979 keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
bugzilla·2026-04-06·CVSS 6.5
CVE-2026-37979 [MEDIUM] CVE-2026-37979 keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
CVE-2026-37979 keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
Access control vulnerability in Keycloak’s OIDC token introspection endpoint. The flaw is caused by not enforcing that the introspecting client is included in the token’s aud claim before returning introspection results. When a confidential attacker-controlled client obtains or intercepts an access token issued to a different audience, it can call the introspection endpoint and receive the full claim set, including claims intentionally omitted from lightweight access tokens. This can be exploited remotely by any confidential client in the realm with valid credentials. The vulnerability breaks the confidentiality model of lightweight tokens and allows unintended clients to recove
2026-05-19
Published