Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-37979

26
FAUCET Score

A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.

First published: May 19, 2026Last modified: May 20, 2026

Impacted Technologies

VendorProductVersion(s)CPE
>= 26.4, < 26.4.12CPE matchmatch criteria
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.37%
Probability of exploitation in next 30 days
EPSS Percentile
29.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0037 is in the 38th percentile among its peer group of 21,977 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

mavenpatch availablevia ghsa
Product: org.keycloak:keycloak-servicesFixed in: 26.6.2
redhatvendor investigatingvia nvd_reference
View patch
redhatno patchvia redhat_api
Product: Red Hat Build of KeycloakFixed in: rhbk/keycloak-rhel9

Vendor Advisories (2)

mavenGHSA-4x37-hw65-52w8medium

Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass

May 19, 2026
redhatCVE-2026-37979Moderate

keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass

May 19, 2026

References

access.redhat.com / errata/RHSA-2026:19596
Vendor Advisory
access.redhat.com / errata/RHSA-2026:19597
Vendor Advisory
access.redhat.com / security/cve/CVE-2026-37979
Vendor Advisory
bugzilla.redhat.com / show_bug.cgi
Vendor Advisory