VulnSocial

CVE-2026-16089Disclosure(redhat / build_of_keycloak)

LOWCVSS 5.9 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their own client, potentially allowing them to obtain access tokens for a victim's identity.

redhat CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-472CWE-384

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • build_of_keycloak

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
redhat
Products
build_of_keycloak

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-17: 1PoC Mentioned / Linked · 2026-07-17: 1Technical Details · 2026-07-17: 107-17
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • ExploitGrid@exploitgrid
    Disclosure

    🚨 Critical CVEs today: CVE-2026-9810 (WordPress AI Copilot unauth RCE), CVE-2026-16089 (Keycloak OAuth2 auth code bypass), CVE-2026-15343 (GitHub Dependabot path traversal to RCE), CVE-2026-51082 (Proxmox VE hash dump). Full breakdowns → http://exploitgrid.net #CVE #InfoSec

    Post summary

    The tweet announces several critical CVEs with concise descriptors and directs readers to full breakdowns on exploitgrid.net, focusing on disclosure rather than exploitation or mitigation.

    0000096
    26 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appredhatbuild_of_keycloak---

Explore more

Back to dashboardredhat CVEsbuild_of_keycloak vulnerabilities