CVE-2026-18208
Received Received - Intake

Keycloak OIDC Token Introspection Information Disclosure

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Red Hat, Inc.

Description
A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-18208
EUVD
EUVD-2026-51482

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Keycloak's OIDC token introspection endpoint. When a confidential client requests introspection of a token meant for a different audience, the endpoint incorrectly returns the full token claims in a signed JWT even though the token is inactive for that client. This allows unauthorized access to sensitive token data.

Detection Guidance

To detect this vulnerability, check if Keycloak is configured with client.introspection.response.allow.jwt.claim.enabled set to true. Review OIDC token introspection responses for signed JWT fields when tokens are marked inactive due to audience mismatch. Monitor logs for confidential clients requesting application/jwt responses.

Impact Analysis

An attacker could exploit this to bypass audience restrictions and access sensitive information contained in tokens they are not authorized to view. This could lead to unauthorized data exposure or privilege escalation depending on the token's contents.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive personal or health data, violating GDPR's data protection principles or HIPAA's privacy rules. Organizations using Keycloak may face compliance violations and potential regulatory penalties.

Mitigation Strategies

Update Keycloak to the latest version to address the OIDC token introspection flaw. Ensure confidential clients are configured to reject unsigned or incorrectly signed introspection responses. Review and restrict token audience configurations to prevent unauthorized access to sensitive claims.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18208. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart