CVE-2026-37977Low· 3.7▾ SunlitA flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the `azp` claim from a cli…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.3%
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token (JWT) is used to set the Access-Control-Allow-Origin header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled azp value is processed, this value is reflected as the CORS origin, even if the grant is later rejected. This can lead to the exposure of low-sensitivity information from authorization server error responses, weakening origin isolation, but only when a target client is misconfigured with webOrigins: ["*"].
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119285Medium· 5.9Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
CVE-2026-118657Medium· 5.9Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
CVE-2026-118651Medium· 5.3Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
CVE-2026-115413High· 7.8AWS API MCP Server OAuth Token Audience Validation Bypass
CVE-2026-82332Medium· 5.6Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijacking
CVE-2026-110737Low· 2.3Push Endpoint Returns Permissive CORS Headers