Medium severity · published May 19, 2026
CVE-2026-37979
Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat build of Keycloak 26.4 · Red Hat
All versions, or not specified · source: vendor
BO
Build OF Keycloak · Redhat
26.4 before 26.4.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-37979
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-37979
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19596
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19597
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-37979
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2455328
More from Red Hat build of Keycloak 26.4
9.8
CVE-2026-16442
Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
9.1
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
9.1
CVE-2026-16443
Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
8.8
CVE-2026-15572
Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
8.8
CVE-2026-9704
Keycloak: keycloak: privilege escalation due to oversized subject_token jwt