Quick answers
- Is CVE-2026-16089 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16089 being exploited in the wild.
- How severe is CVE-2026-16089?
- Medium severity, with a CVSS score of 5.4, published 17 July 2026.
- Which products and versions are affected?
- Red Hat build of Keycloak unspecified.
- Is there a fix for CVE-2026-16089?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-16089 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-16089?
- Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the keycloak-services component where OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. The authorization code payload fails to persist the issuing client identifier, and the token endpoint relies on a mutable component of the code string to identify the client session. An attacker with a registered client in the same realm can intercept a victim's authorization code, rewrite the client identifier, and redeem it at the token endpoint. This allows the attacker to obtain access tokens associated with the victim's identity for the attacker-controlled client. Exploitation requires the attacker to have network access to intercept the code and a valid client registration.
Affected products
- Red Hat Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-17: disclosed: CVE published and reported to Red Hat Bugzilla