# CVE-2026-16089: Red Hat Build of Keycloak authorization code retargeting in keycloak-services

Source: https://junglewise.ai/threats/cve-2026-16089-red-hat-build-of-keycloak-authorization-code-retargeting-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-16089 · Severity: medium · CVSS 5.4 · Published 2026-07-17

A security flaw was identified in Red Hat Build of Keycloak, an identity and access management solution. The vulnerability allows an attacker to intercept a user's login code and redirect it to their own malicious application. If successful, the attacker could obtain access tokens for the victim's identity, potentially leading to unauthorized access to user data and account impersonation.

Technologies: [Red Hat build of Keycloak](https://junglewise.ai/threats/technologies/red-hat-keycloak). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-16089 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16089 being exploited in the wild.

**How severe is CVE-2026-16089?** Medium severity, with a CVSS score of 5.4, published 17 July 2026.

**Which products and versions are affected?** Red Hat build of Keycloak unspecified.

**Is there a fix for CVE-2026-16089?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16089 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16089?** Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the keycloak-services component where OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. The authorization code payload fails to persist the issuing client identifier, and the token endpoint relies on a mutable component of the code string to identify the client session. An attacker with a registered client in the same realm can intercept a victim's authorization code, rewrite the client identifier, and redeem it at the token endpoint. This allows the attacker to obtain access tokens associated with the victim's identity for the attacker-controlled client. Exploitation requires the attacker to have network access to intercept the code and a valid client registration.

## Affected products

- Red Hat Red Hat Build of Keycloak unspecified

## Timeline

- 2026-07-17: disclosed: CVE published and reported to Red Hat Bugzilla

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)
- [https://access.redhat.com/security/cve/CVE-2026-16089](https://access.redhat.com/security/cve/CVE-2026-16089)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2501724](https://bugzilla.redhat.com/show_bug.cgi?id=2501724)

## Related threats

- [Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management)
- [Red Hat Build of Keycloak OIDC logout session fixation](https://junglewise.ai/threats/cve-2026-107124-a-flaw-was-found-in-the-oidc-logout-endpoint-of-the-keycloak)
- [Keycloak theme resource disk exhaustion](https://junglewise.ai/threats/cve-2026-110932-a-flaw-was-found-in-the-theme-resource-endpoint-of-keycloak-an)
- [Keycloak secure-redirect-uris-enforcer open redirect via DNS resolution](https://junglewise.ai/threats/cve-2026-118425-a-flaw-was-found-in-the-secure-redirect-uris-enforcer-client)
- [Keycloak OIDC Dynamic Client Registration offline token revocation bypass](https://junglewise.ai/threats/cve-2026-107623-a-flaw-was-found-in-the-oidc-dynamic-client-registration-dcr)