CVE-2026-37979
mediumA flaw was found in Keycloak.
Vendor / product: Redhat — build of keycloak
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
CVSS
6.5
6.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Severity source: NVD CVSS v3.1 (secalert@redhat.com)
Timeline (UTC)
Published: 2026-05-19 12:16
Modified: 2026-10-29 10:17
NVD status: Modified
Last synced 47 minutes ago
Verified against the source API 2026-10-29 10:29 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
redhat / build_of_keycloak ≥26.4 <26.4.12
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:19596
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:19597
Vendor advisory: https://access.redhat.com/security/cve/CVE-2026-37979
Vendor advisory: https://bugzilla.redhat.com/show_bug.cgi?id=2455328
References
- https://access.redhat.com/errata/RHSA-2026:19596 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:19597 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2026-37979 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2455328 secalert@redhat.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-29 10:29 UTC · record ↗