CVE-2026-16089 is a medium severity vulnerability in Red Hat Build of Keycloak's keycloak-services component. The issue arises from improper binding of OAuth 2.0 authorization codes to the client that requested them. This allows an attacker who can intercept an authorization code to modify it and redeem it with their own client, potentially obtaining access tokens associated with a victim's identity. The vulnerability is classified under CWE-384 (Session Fixation). There is no vendor advisory detail indicating the availability of a patch or workaround at this time.

An attacker capable of intercepting OAuth 2.0 authorization codes can manipulate these codes to obtain access tokens for a victim's identity, potentially leading to unauthorized access to protected resources. The confidentiality of user identities is at risk, while integrity and availability impacts are low or not indicated.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16089 for current remediation guidance. Until a fix is available, organizations should consider minimizing exposure to interception of authorization codes, such as enforcing secure transport (TLS) and reviewing OAuth client configurations. No official fix or workaround is currently documented.