VulnSocial

CVE-2026-37979Disclosure(redhat / build_of_keycloak)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other resource servers, compromising the confidentiality of lightweight access tokens. This issue can be exploited remotely by any confidential client in the realm with valid credentials.

redhat CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • build_of_keycloak

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-05-21); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
redhat
Products
build_of_keycloak

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-21: 1Mentions · 2026-06-03: 1Technical Details · 2026-05-21: 105-2106-03
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-05-211
Disclosure1
2026-06-031
General1
Full discourse2 posts
  • Specterbyte@Specterbyt5ds1
    Disclosure

    Just got a reward for a vulnerability submitted on @yeswehack - Insecure Direct Object Reference (IDOR) (CWE-639). BINGO https://www.cve.org/CVERecord?id=CVE-2026-37979 https://access.redhat.com/security/cve/cve-2026-37979 https://yeswehack.com/hunters/herdiyanitdev #YesWeRHackers https://t.co/W6OyfhZ2CK

    Post summary

    The user announces a rewarded vulnerability (CVE-2026-37979) described as an IDOR (CWE-639); no PoC, exploit, or patch details are provided.

    200513614
    48 followersView on X
  • DailyCVE@dailycve
    General

    🟠 Keycloak, Authorization Bypass in OIDC Token Introspection, #CVE-2026-37979 (Medium) -DC-Jun2026-174 https://dailycve.com/keycloak-authorization-bypass-in-oidc-token-introspection-cve-2026-37979-medium-dc-jun2026-174/

    Post summary

    The brief entry announces a Medium‑severity Keycloak vulnerability (CVE‑2026‑37979) without providing any PoC, exploit, patch, or detailed technical information.

    0000049
    208 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appredhatbuild_of_keycloak---

Explore more

Back to dashboardredhat CVEsbuild_of_keycloak vulnerabilities