CVE-2026-19688: Keycloak-services: keycloak-services: admin api missing audience check
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
Other sources
A Missing Audience Check vulnerability was identified in the Keycloak Admin REST API. The flaw exists in the AdminRoot.authenticateRealmAdminRequest function, which constructs a BearerTokenAuthenticator without specifying an expected audience. Consequently, the audience validation step in AuthenticationManager.verifyIdentityToken is bypassed. An attacker who operates or compromises a client in a realm can capture an access token from an authenticating administrator (requiring user interaction). If the token contains administrative roles—which is common when the default full scope allowed setting is enabled—the attacker can replay this token against the Admin API. Successful exploitation allows the attacker to perform any action permitted by the captured roles, such as modifying realm configurations, managing users, or deleting resources.
— Red Hat