CVE-2026-105302: Exposure of Sensitive Information to an Unauthorized Actor in Red Hat Red Hat Build of Keycloak

The vulnerability exists in the User Session Note mapper component of the Red Hat Build of Keycloak identity and access management solution. The mapper fails to validate whether requested session notes contain sensitive internal credentials, including federated access tokens from external identity providers. As a result, a delegated client administrator can cause these upstream bearer tokens to be leaked into tokens issued to their managed applications. This exposure could allow unauthorized access to the user's data on external platforms that rely on those tokens.

The vulnerability can lead to the exposure of sensitive federated access tokens to unauthorized actors with delegated client administrator privileges. This exposure may result in unauthorized access to user data on external identity provider platforms. The CVSS v3.1 base score is 5.7 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with high confidentiality impact but no integrity or availability impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-105302 for current remediation guidance. Until an official fix is available, restrict delegated client administrator privileges to trusted users only and monitor for unusual token issuance behavior. Do not assume the vulnerability is mitigated without vendor confirmation.