This vulnerability exists in the OIDC token introspection endpoint of the keycloak-services component used in Red Hat Build of Keycloak. When a confidential client configured to receive signed JWT introspection responses introspects a token issued for a different audience, the endpoint correctly marks the token as inactive but still returns the full token claims inside a signed JWT field. This behavior allows an unauthorized client to bypass audience-based access controls and access sensitive information contained in the token. The root cause is a failure to sanitize the signed JWT field in the introspection response when the token is inactive due to an audience mismatch. Exploitation requires the attacker to control a confidential client in the same realm and have a valid token issued for a different audience. Red Hat rates the severity as moderate (CVSS 6.5) and currently has no mitigation or official fix available that meets their criteria for ease of use, applicability, or stability.

An attacker who controls a confidential client within the same realm and possesses a valid token for a different audience can bypass audience-based restrictions and obtain sensitive token claims that should be protected. This leads to unauthorized disclosure of sensitive information contained in the token. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity) with a high confidentiality impact and no impact on integrity or availability.

Currently, Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates. Since exploitation requires control of a confidential client within the same realm and possession of a valid token for a different audience, limiting client registrations and token issuance scope may reduce risk. Customers with a Red Hat Technical Account Manager (TAM) can consult directly for guidance. No other specific mitigations are recommended by Red Hat at this time.