CVE-2026-0707

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:3947
https://access.redhat.com/errata/RHSA-2026:3948
https://access.redhat.com/security/cve/CVE-2026-0707
https://bugzilla.redhat.com/show_bug.cgi?id=2427768
https://github.com/keycloak/keycloak/issues/49433

Configurations

No configuration.

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en Keycloak. El analizador del encabezado de autorización de Keycloak es excesivamente permisivo con respecto al formato del esquema de autenticación ’Bearer’. Acepta caracteres no estándar (como tabulaciones) como separadores y tolera variaciones de mayúsculas y minúsculas que se desvían de las especificaciones de la RFC 6750.

Information

Published : 2026-01-08 04:15

Updated : 2026-10-26 21:10

NVD link : CVE-2026-0707

Mitre link : CVE-2026-0707

CVE.ORG link : CVE-2026-0707

JSON object : View

Products Affected

No product.

CWE

CWE-551

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

{"id": "CVE-2026-0707", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0707", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:54:59.827077Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4.10-1", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.10", "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-01-08T04:15:56.520", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:3947", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:3948", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-0707", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427768", "source": "secalert@redhat.com"}, {"url": "https://github.com/keycloak/keycloak/issues/49433", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-551"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the \"Bearer\" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Keycloak. El analizador del encabezado de autorizaci\u00f3n de Keycloak es excesivamente permisivo con respecto al formato del esquema de autenticaci\u00f3n \u2019Bearer\u2019. Acepta caracteres no est\u00e1ndar (como tabulaciones) como separadores y tolera variaciones de may\u00fasculas y min\u00fasculas que se desv\u00edan de las especificaciones de la RFC 6750."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "secalert@redhat.com"}