Red Hat Keycloak EUVD-2026-30887

Exploitation requires that the attacker control or have access to a confidential client registered within the target Keycloak realm, including a valid client ID and client secret - corresponding to CVSS PR:L (low-privilege authenticated access). The target deployment must expose the OIDC token introspection endpoint, which is a standard feature of Keycloak and enabled by default for confidential clients. The attacker must also possess or be able to obtain an access token issued to another resource server in the same realm (e.g., by intercepting a token, or by having a user authenticate through the attacker's client). What limits exploitation: the attacker cannot be entirely external with no realm presence - they must hold valid confidential client credentials; the attack is scoped to a single Keycloak realm (S:U) and does not directly cross realm boundaries; and there is no integrity or availability impact, confining damage to information disclosure of token claims.

The CVSS 6.5 score reflects a network-exploitable (AV:N), low-complexity (AC:L), low-privilege (PR:L) vulnerability with high confidentiality impact (C:H) and no integrity or availability impact (I:N/A:N). The PR:L designation is critical: exploitation requires the attacker to control a confidential client with valid credentials already registered in the target realm - this is not an unauthenticated attack. In practice this means the attacker must either be a malicious but legitimately registered application in the realm, or have compromised another application's client secret. The unchanged scope (S:U) limits blast radius to the realm in question. No EPSS score was provided in the available data, and the vulnerability is not in CISA KEV, so widespread opportunistic exploitation has not been confirmed. Despite the moderate overall score, the confidentiality impact is high because token claims can include identity assertions, roles, and session metadata that downstream services rely on for authorization decisions. The realistic risk is highest in Keycloak deployments with many confidential clients, SaaS multi-tenant architectures, or environments where clients are registered by untrusted or semi-trusted parties.

An attacker who controls a confidential client legitimately registered in a Keycloak realm - or who has obtained the client ID and secret of such a client - authenticates to Keycloak and then calls the OIDC token introspection endpoint with access tokens issued to other resource servers in the same realm. Because audience restrictions are not enforced correctly, the endpoint returns sensitive token claims (such as user identity, roles, or session metadata) that were intended only for the token's legitimate audience, allowing the attacker to harvest privileged information about users and their sessions across services. No public exploit code has been identified at time of analysis, and the low complexity (AC:L) means no special tooling beyond a standard OIDC client library is required.