EUVD-2026-19201
GHSA-5v8v-xvjv-57x7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5Blast Radius
ecosystem impact- 50 maven packages depend on org.keycloak:keycloak-services (22 direct, 28 indirect)
Ecosystem-wide dependent count for version 26.5.0.
DescriptionNVD
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token (JWT) is used to set the Access-Control-Allow-Origin header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled azp value is processed, this value is reflected as the CORS origin, even if the grant is later rejected. This can lead to the exposure of low-sensitivity information from authorization server error responses, weakening origin isolation, but only when a target client is misconfigured with webOrigins: ["*"].
AnalysisAI
CORS header injection in Keycloak's User-Managed Access token endpoint allows remote attackers to reflect attacker-controlled origin values before JWT signature validation, potentially exposing low-sensitivity authorization error responses when clients are misconfigured with wildcard origin permissions. The vulnerability requires high attack complexity and affects only clients explicitly configured with webOrigins set to "*", resulting in a low-severity information disclosure with limited real-world exploitability.
Technical ContextAI
The vulnerability exists in Keycloak's UMA token endpoint implementation, which handles Cross-Origin Resource Sharing (CORS) header processing. The root cause is a violation of CWE-346 (Origin Validation Error) where the Access-Control-Allow-Origin response header is populated using the azp (authorized party) claim extracted from a client-supplied JWT before the JWT's cryptographic signature is validated. Keycloak processes the JWT payload and reflects the attacker-controlled azp claim value directly into the CORS header, then subsequently rejects the grant due to signature validation failure. This ordering allows CORS origin poisoning even though the ultimate authorization request fails. The attack surface is limited to deployments where Keycloak clients are configured with webOrigins: ["*"], which disables standard same-origin policy restrictions for that client.
RemediationAI
Patch status and exact remediation version numbers are not provided in available data. Administrators should immediately consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-37977 and the corresponding Bugzilla report at https://bugzilla.redhat.com/show_bug.cgi?id=2455324 for patched version availability and deployment guidance. As an interim mitigation, clients should immediately revise their webOrigins configuration from the permissive wildcard value "*" to an explicit, restricted list of legitimate origins required for application functionality. This configuration change eliminates the attack surface by restoring proper same-origin policy enforcement and should be implemented independently of patch availability.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-346 – Origin Validation Error
View allSame technique Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today