CVE-2026-7571

Vulnerability

A flaw in Keycloak allows a low-privilege attacker with knowledge of user credentials and a client ID to bypass the security control that disables the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, the attacker can obtain an access token that should not be available. This issue affects Keycloak versions prior to 26.4.12 [1][4].

Exploitation

An attacker must have low-privilege access (e.g., a regular user) and know the victim's credentials and the client ID. During a session restart, the attacker manipulates client data to re-enable the implicit flow, tricking the server into issuing an access token that should be blocked [1][4].

Impact

Successful exploitation leads to the disclosure of access tokens that should not be issued. These tokens can also be exposed in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure [1][4].

Mitigation

The vulnerability is fixed in Red Hat build of Keycloak 26.4.12, released on 2026-05-20 [2][3]. Users should upgrade to version 26.4.12 or later. No workarounds are documented.