Medium severity6.5NVD Advisory· Published May 19, 2026· Updated Jun 3, 2026
CVE-2026-37979
CVE-2026-37979
Description
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | < 26.6.2 | 26.6.2 |
Affected products
2Patches
Vulnerability mechanics
References
8- access.redhat.com/errata/RHSA-2026:19596nvdVendor AdvisoryWEB
- access.redhat.com/errata/RHSA-2026:19597nvdVendor AdvisoryWEB
- access.redhat.com/security/cve/CVE-2026-37979nvdVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdVendor AdvisoryWEB
- github.com/advisories/GHSA-4x37-hw65-52w8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-37979ghsaADVISORY
- github.com/keycloak/keycloak/issues/49113ghsaWEB
- github.com/keycloak/keycloak/releases/tag/26.6.2ghsaWEB
News mentions
0No linked articles in our index yet.