CVE-2026-0707: Keycloak: keycloak authorization header parsing leading to potential security control bypass
A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.
Other sources
Keycloak’s authentication pipeline excessively tolerates non-standard Bearer token formats (case variations, Tab characters, multiple spaces, mixed whitespace) in the Authorization header, creating inconsistencies with front-end security controls (WAF/proxies) and enabling potential bypass risks.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0707?
CVE-2026-0707 is considered a medium severity vulnerability due to its potential impact on authentication processes.
How do I fix CVE-2026-0707?
To fix CVE-2026-0707, ensure that you update your Keycloak installation to the latest version that addresses this vulnerability.
What are the potential impacts of CVE-2026-0707?
The impacts of CVE-2026-0707 include the possibility of unauthorized access if the authentication header is manipulated using non-standard formats.
Is CVE-2026-0707 present in all versions of Keycloak?
CVE-2026-0707 potentially affects multiple versions of Keycloak, particularly those that do not implement strict parsing of the Bearer token.
How can I prevent exploitation of CVE-2026-0707?
To prevent exploitation of CVE-2026-0707, validate Bearer token formats strictly according to RFC 6750 and regularly update Keycloak.