5.4mediumMedium
CVE-2026-16089
Redhat Build Of Keycloak
A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their own client, potentially allowing them to obtain access tokens for a victim's identity.
Exploitation status
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
- To exploit it, an ordinary user account is needed.
- Beyond that, someone has to be persuaded to take an action first.
Scoring
- CVSS
- 5.4 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N- Weakness
- CWE-472
- Assigned by
- secalert@redhat.com
Dates
- Published
- 2026-07-17
- Last modified
- 2026-08-31
- Sources
- NVD
Affected products
- Redhat Build Of Keycloakall versions
As listed in the NVD configuration data. Not a statement about your estate.