---
id: CVE-2026-37979
title: >-
  Keycloak: keycloak: information disclosure via oidc token introspection
  endpoint audience bypass
summary: >-
  A flaw was found in Keycloak. This access control vulnerability in Keycloak's
  OpenID Connect (OIDC) token introspection endpoint allows a confidential
  client to bypass audience restrictions. An attacker-controlled client with
  valid crede…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Red Hat
product: rhbk/keycloak-operator-bundle
affected:
  - rhbk/keycloak-operator-bundle (all versions)
  - rhbk/keycloak-rhel9 (all versions)
  - rhbk/keycloak-rhel9-operator (all versions)
  - rhbk/keycloak-rhel9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-05-19T13:39:36.285295Z'
published: '2026-05-19'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T09:29:05.708Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-37979'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:19596'
    label: 'RHSA-2026:19596'
  - url: 'https://access.redhat.com/errata/RHSA-2026:19597'
    label: 'RHSA-2026:19597'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-37979'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2455328'
    label: RHBZ#2455328
tags:
  - cve.org
epss: 0.00366
epssPercentile: 0.30445
ingestedAt: '2026-10-31T04:17:25.423Z'
---

## Overview

A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.

## Affected

- `rhbk/keycloak-operator-bundle (all versions)`
- `rhbk/keycloak-rhel9 (all versions)`
- `rhbk/keycloak-rhel9-operator (all versions)`
- `rhbk/keycloak-rhel9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.