REDHAT-BUG-2545802: Medium severity Red Hat Keycloak vulnerability
A vulnerability was found in Keycloak where the Dynamic Client Registration (DCR) flow does not properly filter sensitive client attributes. Specifically, a registrant using an Initial Access Token can set the internal attribute allow.token.introspection.without.audience.check during the registration process. This attribute disables the mandatory audience verification on the token introspection endpoint. To exploit this flaw, an attacker must possess a valid Initial Access Token for a realm where DCR is enabled. By registering a malicious client with this attribute, the attacker can then use that client's credentials to introspect any active access token they have obtained or intercepted from other clients in the same realm. Successful exploitation results in the disclosure of the full claim set of the token, including user identity, roles, scopes, and session IDs, regardless of whether the introspecting client was the intended audience. This is a bypass of the security controls introduced to fix CVE-2026-37979.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
A realm is exposed if Dynamic Client Registration is enabled and an attacker can obtain a valid Initial Access Token for that realm. Exploitation is limited to tokens from the same realm.
What does an attacker need to exploit it?
The attacker needs a valid Initial Access Token and access to an active access token issued to another client in the same realm, such as one they obtained or intercepted. They can register a client that disables audience checking and use that client's credentials for introspection.
What information can be disclosed?
The attacker can retrieve the full claim set from an active access token even when their client is not the token's intended audience. Exposed claims can include user identity, roles, scopes, and session IDs.
How can I determine whether an attempted exploitation occurred?
Review clients registered through Dynamic Client Registration for the internal attribute allow.token.introspection.without.audience.check. Its presence on a client indicates that audience verification may have been disabled for introspection using that client's credentials.