OpenID Connect Token Bypass Vulnerability in Keycloak by Red Hat

CVE-2026-7571

What is CVE-2026-7571?

A security vulnerability has been identified in Keycloak that allows a low-privilege user, with knowledge of their credentials and client ID, to bypass security measures intended to disable the implicit flow used in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can illicitly obtain access tokens that should remain inaccessible. This exploitation may further result in sensitive access tokens being unintentionally exposed in server logs, proxy logs, and HTTP Referrer headers, creating potential risks for sensitive data leakage.

References