MEDIUM6.5
GHSA-4x37-hw65-52w8
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
Quick fix
GHSA-4x37-hw65-52w8 — org.keycloak:keycloak-services: upgrade to the fixed version with the command below.
# pom.xml: bump <version>26.6.2</version> for org.keycloak:keycloak-servicesDetails
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.keycloak:keycloak-services
Introduced in:
0Fixed in: 26.6.2Fix
# pom.xml: bump <version>26.6.2</version> for org.keycloak:keycloak-servicesReferences
- https://nvd.nist.gov/vuln/detail/CVE-2026-37979[ADVISORY]
- https://github.com/keycloak/keycloak/issues/49113[WEB]
- https://access.redhat.com/errata/RHSA-2026:19596[WEB]
- https://access.redhat.com/errata/RHSA-2026:19597[WEB]
- https://access.redhat.com/security/cve/CVE-2026-37979[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=2455328[WEB]
- https://github.com/keycloak/keycloak[PACKAGE]
- https://github.com/keycloak/keycloak/releases/tag/26.6.2[WEB]