REDHAT-BUG-2508304: Medium severity Keycloak keycloak-services vulnerability

An information disclosure vulnerability was identified in Keycloaks OIDC token introspection endpoint. This flaw is an incomplete fix for CVE-2026-37979. While the original fix correctly enforced audience checks by marking out-of-audience tokens as inactive, it failed to sanitize the jwt field in the response when JWT introspection responses are enabled. The vulnerability exists in the keycloak-services component. When a confidential client with the client.introspection.response.allow.jwt.claim.enabled attribute set to true requests an application/jwt response, the server includes a signed JWT representation of the token even if the audience check fails. An attacker who controls a confidential client in the same realm and obtains a valid access token issued for a different client can exploit this to: Recover sensitive claims and attributes from lightweight or opaque tokens. Bypass audience-based access control mechanisms intended to restrict introspection metadata. Access internal identity information (roles, groups, user attributes) they are not authorized to view.