CVE-2026-7571

A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:19596	Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19597	Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-7571	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2464263	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una falla fue encontrada en Keycloak. Un usuario de bajo privilegio, con conocimiento de las credenciales de usuario y el ID de cliente, puede eludir un control de seguridad destinado a deshabilitar el flujo implícito en clientes de OpenID Connect (OIDC). Al manipular datos del cliente durante un reinicio de sesión, un atacante puede obtener un token de acceso que no debería estar disponible. Esta vulnerabilidad también puede llevar a la exposición de estos tokens de acceso en registros del servidor, registros de proxy y encabezados HTTP Referrer, lo que resulta en revelación de información sensible.

Information

Published : 2026-05-19 12:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-7571

Mitre link : CVE-2026-7571

CVE.ORG link : CVE-2026-7571

JSON object : View

Products Affected

redhat

build_of_keycloak

CWE

CWE-472

External Control of Assumed-Immutable Web Parameter

{"id": "CVE-2026-7571", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7571", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T11:57:40.751926Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4.12-1", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4", "versions": [{"status": "unaffected", "version": "26.4-17", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:26.4::el9"], "vendor": "Red Hat", "product": "Red Hat build of Keycloak 26.4.12", "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-19T12:16:19.820", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:19596", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:19597", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-7571", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464263", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-472"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure."}, {"lang": "es", "value": "Una falla fue encontrada en Keycloak. Un usuario de bajo privilegio, con conocimiento de las credenciales de usuario y el ID de cliente, puede eludir un control de seguridad destinado a deshabilitar el flujo impl\u00edcito en clientes de OpenID Connect (OIDC). Al manipular datos del cliente durante un reinicio de sesi\u00f3n, un atacante puede obtener un token de acceso que no deber\u00eda estar disponible. Esta vulnerabilidad tambi\u00e9n puede llevar a la exposici\u00f3n de estos tokens de acceso en registros del servidor, registros de proxy y encabezados HTTP Referrer, lo que resulta en revelaci\u00f3n de informaci\u00f3n sensible."}], "lastModified": "2026-10-26T13:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E71FD53F-2C05-4B84-9BEE-BB287017B322", "versionEndExcluding": "26.4.12", "versionStartIncluding": "26.4"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}