CVE-2026-19688Medium· 6.8▾ SunlitA flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a clie…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
keycloak-services (all versions)rhbk-openshift-rhel9/rhbk-openshift-rhel9 (all versions)keycloak-servicesRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96447Medium· 4.2Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding
CVE-2026-97367Medium· 6.4Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
CVE-2026-97175High· 8.8Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
CVE-2026-97847High· 7.1Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
CVE-2026-118959Medium· 5.4Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
CVE-2026-114438Medium· 4.2Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering