This vulnerability in Red Hat Build of Keycloak involves improper enforcement of audience restrictions on the OIDC token introspection endpoint. A malicious confidential client with valid credentials can access token claims meant for other resource servers, leading to unauthorized disclosure of sensitive token information. The issue affects the confidentiality aspect of security but does not impact integrity or availability. Exploitation requires valid client credentials and can be performed remotely within the same realm. The vendor advisory does not currently specify a remediation or patch status.

Exploitation of this vulnerability allows an attacker-controlled confidential client to bypass audience restrictions and obtain sensitive token claims intended for other resource servers. This results in a confidentiality breach of lightweight access tokens. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-37979 for current remediation guidance. Until an official fix is available, restrict confidential client credentials to trusted entities only and monitor for unusual token introspection requests within the realm. Avoid deploying untrusted confidential clients that could exploit this vulnerability.