CVE-2026-37979

Vulnerability

A flaw in Keycloak's OpenID Connect token introspection endpoint fails to verify that the requesting client is included in the token's aud claim before returning claims. This affects Keycloak versions prior to 26.4.12 [1][2]. The endpoint does not enforce that the introspecting client is among the intended audiences, allowing unauthorized retrieval of token claims.

Exploitation

An attacker-controlled confidential client with valid credentials can call the introspection endpoint for any access token, including tokens issued to a different resource server. The attacker can obtain or intercept such tokens and use the introspection endpoint to retrieve the full claim set [4]. No additional privileges beyond valid client credentials are required.

Impact

Successful exploitation leads to information disclosure of sensitive token claims that were intended only for the legitimate audience. This breaks the confidentiality model of lightweight access tokens, potentially exposing attributes meant to be omitted from the token itself [1][4].

Mitigation

The issue is fixed in Keycloak version 26.4.12, released on 2026-05-20 [2][3]. Users should update to this version or later. No workaround is mentioned; updating is the recommended action.