This vulnerability in Red Hat build of Keycloak 26.4 allows a remote attacker to inject a malicious origin into the Access-Control-Allow-Origin header via the 'azp' claim in a JWT before signature validation. Because the origin is reflected even if the JWT grant is later rejected, it can weaken origin isolation and lead to exposure of low-sensitivity information from error responses. The issue requires a misconfiguration where the client has webOrigins set to ['*']. The CVSS score is 3.7 (low severity). The vendor advisory indicates no explicit patch or fix currently available for this specific issue but references updated Keycloak 26.6.3 images addressing multiple vulnerabilities including this one. However, no direct fix for this CVE is explicitly stated in the advisory, and the remediation level is not provided. The vulnerability is not in a cloud service, and no known exploits are reported in the wild.

The impact is limited to potential exposure of low-sensitivity information from authorization server error responses due to weakened origin isolation caused by CORS header injection. There is no impact on integrity or availability. Exploitation requires a misconfigured client with webOrigins set to ['*'], which is not a default or recommended configuration. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and only confidentiality impact (low).

The vendor advisory does not explicitly state a patch or official fix for this vulnerability. However, updated Red Hat build of Keycloak 26.6.3 images are available that address multiple security issues including this one. Users should upgrade to Red Hat build of Keycloak 26.6.3 or later to obtain these fixes. Additionally, clients should avoid misconfiguration by not setting webOrigins to ['*'], thereby reducing exposure to this vulnerability. Back up existing installations before applying updates. Monitor the vendor advisory for any future updates or patches specific to this issue.