VULNERABILITY INTELLIGENCE

CVE-2026-18208

CVSS score6.5 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-07-31
Last modified2026-08-07
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.

Weakness classification

  • secalert@redhat.com: CWE-862

Primary references