Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-28T13:29:44 keycloak-services: keycloak-services: Inactive out-of-audience token introspection leaks signed JWT claim 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-862

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to control a confidential client within the same realm and possess a valid token issued for a different audience. Successful exploitation allows an attacker to recover sensitive token claims that should be restricted by audience-based access controls. The vulnerability's root cause is a failure to sanitize the signed JWT field in the introspection response when a token is determined to be inactive due to an audience mismatch. Red Hat would like to thank Paul Bottinelli (Trail of Bits) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Build of Keycloak Fix deferred keycloak-services Red Hat Build of Keycloak Fix deferred rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat Build of Keycloak Fix deferred rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Data Grid 8 Not affected keycloak-services Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected keycloak-services Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-18208 https://nvd.nist.gov/vuln/detail/CVE-2026-18208