CVE-2026-0707: Keycloak permissive Authorization header parsing bypass

CVE-2026-0707 · Severity: medium · CVSS 5.3 · Published 2026-01-08

Keycloak is an open-source identity and access management solution used to secure applications and services. A flaw in how it processes authentication headers allows it to accept non-standard formatting, such as extra spaces or tabs, when identifying security tokens. This inconsistency can allow an attacker to bypass security filters like Web Application Firewalls (WAFs) that expect strict adherence to standards, potentially leading to unauthorized access.

Technologies: Keycloak, org.keycloak:keycloak-parent (Maven), Red Hat build of Keycloak. Vendors: Keycloak, Maven, Red Hat.

Quick answers

Is CVE-2026-0707 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0707 being exploited in the wild.
How severe is CVE-2026-0707?
Medium severity, with a CVSS score of 5.3, published 8 January 2026.
Which products and versions are affected?
Keycloak <= 26.5.0, Up to 26.4.10; org.keycloak:keycloak-parent (Maven) <= 26.5.0, ECOSYSTEM:introduced=0,last_affected=26.5.0; Red Hat build of Keycloak < 26.4.10, Up to 26.4.10.
Is there a fix for CVE-2026-0707?
A patch was published on 2026-03-05: Red Hat released patches for Red Hat build of Keycloak Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0707 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-0707?
Check whether you run Keycloak, org.keycloak:keycloak-parent (Maven) or Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Keycloak's Authorization header parsing logic (CWE-551). The parser is overly permissive regarding the 'Bearer' authentication scheme, accepting non-standard separators (such as tab characters, multiple spaces, or mixed whitespace) and case variations that deviate from RFC 6750. This behavior creates a discrepancy between Keycloak and front-end security controls like Web Application Firewalls (WAFs) or reverse proxies. An attacker can exploit this 'impedance mismatch' to smuggle authentication headers past security filters that do not recognize the malformed syntax, while Keycloak still processes them as valid, potentially bypassing intended security policies. The issue is addressed in Red Hat build of Keycloak 26.4.10.

Affected products

  • Keycloak Keycloak <= 26.5.0
  • Red Hat Red Hat build of Keycloak < 26.4.10

Identifiers

  • CVE-2026-0707
  • GHSA-gv94-wp4h-vv8p

Timeline

  • 2026-01-08: disclosed
  • 2026-01-08: advisory
  • 2026-03-05: patched: Red Hat released patches for Red Hat build of Keycloak

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.