Unauthorized OIDC Introspection Exposure in Keycloak Services
CVE-2026-18208 Published on July 31, 2026
Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim
A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.
Vulnerability Analysis
CVE-2026-18208 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-18208 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-18208
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
