Bearer Token Misconfiguration in Keycloak Admin REST API
CVE-2026-19688

6.8MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
6 November 2026

What is CVE-2026-19688?

A significant flaw has been identified in the Admin REST API of Keycloak, which affects its ability to accurately verify the intended audience of bearer tokens during the authentication process. This vulnerability grants attackers operating within a realm the opportunity to intercept an administrator's access token. By reusing this token, an attacker can execute unauthorized administrative actions, posing a serious risk of compromising the entire realm and affecting the integrity of the identity management system.

References

https://access.redhat.com/security/cve/CVE-2026-19688
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2514534
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Pedro Igor Silva (IBM) for reporting this issue.
.