CVE-2026-37979: Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
Other sources
Access control vulnerability in Keycloak’s OIDC token introspection endpoint. The flaw is caused by not enforcing that the introspecting client is included in the token’s aud claim before returning introspection results. When a confidential attacker-controlled client obtains or intercepts an access token issued to a different audience, it can call the introspection endpoint and receive the full claim set, including claims intentionally omitted from lightweight access tokens. This can be exploited remotely by any confidential client in the realm with valid credentials. The vulnerability breaks the confidentiality model of lightweight tokens and allows unintended clients to recover sensitive attributes meant only for the legitimate resource server.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37979?
The severity of CVE-2026-37979 is classified as critical due to the ability to bypass audience restrictions in Keycloak's OIDC token introspection.
How do I fix CVE-2026-37979?
To fix CVE-2026-37979, update Keycloak to the latest version that addresses this vulnerability.
What are the consequences of CVE-2026-37979?
The consequences of CVE-2026-37979 include potential unauthorized access to sensitive information via unauthorized audience bypass.
Who is affected by CVE-2026-37979?
CVE-2026-37979 affects users of Keycloak that utilize the OIDC token introspection endpoint in a confidential client flow.
What type of vulnerability is CVE-2026-37979?
CVE-2026-37979 is an access control vulnerability allowing information disclosure through audience bypass.