The vulnerability in Red Hat build of Keycloak 26.4 involves an overly permissive Authorization header parser that accepts malformed Bearer tokens with non-standard separators and case variations, violating RFC 6750 specifications. This incorrect behavior order—authorizing before proper parsing and canonicalization—may allow attackers to bypass security controls. The issue has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity only. Red Hat has published security advisories RHSA-2026:3947 and RHSA-2026:3948 that include fixes in Keycloak 26.4.10 standalone packages and container images for OpenShift. Users should update to these fixed versions to remediate the vulnerability.

The vulnerability allows potential security control bypass due to improper parsing of the Authorization header's Bearer token. While it does not impact confidentiality or availability, it affects integrity by potentially allowing unauthorized actions or access. There are no known exploits in the wild at this time. The flaw could be leveraged remotely without authentication or user interaction, increasing exposure risk if unpatched.

Red Hat has released fixed versions of the Red Hat build of Keycloak 26.4.10 standalone server packages and container images that address this vulnerability. Users should back up their existing installations and apply these updates promptly. The vendor advisories RHSA-2026:3947 and RHSA-2026:3948 provide detailed update instructions. No additional mitigations are specified or required beyond applying the official fixes.