REDHAT-BUG-2455324: Low severity Red Hat Keycloak vulnerability

CORS header injection vulnerability in Keycloak’s UMA token endpoint. The flaw is caused by reading the azp claim from a client-supplied JWT to set the Access-Control-Allow-Origin header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled azp value is processed, that value is reflected as the CORS origin even though the grant is later rejected. This can be exploited remotely without authentication when a target client is misconfigured with webOrigins: [""]. Attackers can then read UMA error responses cross-origin, weakening origin isolation and exposing low-sensitivity information from the authorization server.