Executive brief
Keycloak, a popular identity and access management solution, contains a vulnerability in its token introspection endpoint. This flaw allows an authorized but malicious application to bypass security restrictions and view sensitive user data intended for other services. An attacker could use this to gain unauthorized access to private user information or session details, potentially compromising the confidentiality of the entire authentication system.
Technical details
An access control vulnerability exists in Keycloak's OpenID Connect (OIDC) token introspection endpoint (CWE-284). The root cause is a failure to verify that the client requesting introspection is included in the token's 'aud' (audience) claim. A remote attacker with valid confidential client credentials can intercept or obtain a token intended for a different resource server and use the introspection endpoint to retrieve the full set of claims, including sensitive attributes normally omitted from lightweight access tokens. This bypasses the intended security boundaries between different resource servers within the same realm. The issue is resolved in Keycloak version 26.6.2 and Red Hat build of Keycloak 26.4.12.
Affected products
- Keycloak Keycloak < 26.6.2
- Red Hat Red Hat build of Keycloak < 26.4.12
Timeline
- 2026-04-06: other: Reported to Red Hat Bugzilla
- 2026-05-19: disclosed: Initial public disclosure
- 2026-05-19: advisory: GitHub Advisory published
- 2026-05-20: patched: Red Hat released security updates (RHSA-2026:19596)