Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be available. This vulnerability can also lead to the exposure of these access tokens in server logs, proxy logs, and HTTP Referrer headers, resulting in sensitive information disclosure.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 Keycloak, OIDC Implicit Flow Bypass, #CVE-2026-7571 (Critical) -DC-Jun2026-163 https://dailycve.com/keycloak-oidc-implicit-flow-bypass-cve-2026-7571-critical-dc-jun2026-163/
Post summary
The post announces the discovery of a critical Keycloak OIDC implicit flow bypass vulnerability (CVE‑2026‑7571) but offers no detailed technical data, PoC, or evidence of exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | redhat | build_of_keycloak | - | - | - |