Executive brief
Keycloak, a widely used identity and access management tool, contains a flaw in how it handles security token checks. An attacker with access to a registered application can bypass restrictions to view sensitive user information, such as roles and group memberships, that should be hidden from them. This could lead to unauthorized data access and a breakdown of the security boundaries between different applications managed by the same system.
Technical details
A vulnerability exists in the OIDC token introspection endpoint within the keycloak-services component. When a confidential client is configured to receive signed JWT introspection responses (client.introspection.response.allow.jwt.claim.enabled set to true), the server fails to sanitize the 'jwt' field in the response for out-of-audience tokens. While the endpoint correctly marks the token as 'active: false', it still includes the full set of token claims within the signed JWT field. An attacker controlling a confidential client can exploit this to bypass audience-based restrictions and recover sensitive identity information, such as roles and user attributes, from tokens intended for other clients. This is identified as an incomplete fix for a previous vulnerability.
Affected products
- Red Hat Build of Keycloak All versions
- Keycloak Keycloak All versions
Timeline
- 2026-07-29: disclosed: Initial report in Red Hat Bugzilla
- 2026-07-31: advisory: NVD publication date