CVE-2026-16089 describes a security flaw in Red Hat Build of Keycloak's keycloak-services component where OAuth 2.0 authorization codes are not correctly bound to the client that requested them. This improper binding allows an attacker who intercepts an authorization code to alter it so that it can be redeemed by the attacker's client instead of the legitimate one. Successful exploitation could lead to the attacker obtaining access tokens associated with a victim's identity, compromising confidentiality. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor advisory does not specify affected versions or remediation status.

An attacker capable of intercepting OAuth 2.0 authorization codes can manipulate them to be redeemed by their own client, potentially gaining unauthorized access tokens linked to a victim's identity. This compromises confidentiality by allowing unauthorized access to protected resources. Integrity impact is low, and availability is not affected. The vulnerability requires network access, user interaction, and has high attack complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16089 for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, organizations should consider minimizing exposure of authorization codes to interception, such as enforcing secure transport (TLS) and reviewing OAuth client configurations to reduce risk.