The vulnerability in Red Hat build of Keycloak 26.4 (CVE-2026-37979) is an access control flaw in the OIDC token introspection endpoint. It permits a confidential client with valid credentials to bypass audience restrictions, enabling unauthorized retrieval of sensitive token claims meant for other resource servers. This issue compromises token confidentiality and can be exploited remotely by any confidential client within the realm. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and high confidentiality impact without integrity or availability impact. Red Hat's security advisories for Keycloak 26.4.12 include fixes for this vulnerability, recommending upgrading to this version.

Successful exploitation allows a malicious confidential client to access sensitive token claims intended for other resource servers, leading to information disclosure and breach of token confidentiality. This could undermine trust in token-based authentication and authorization mechanisms within affected Keycloak realms. There is no reported impact on integrity or availability. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for Red Hat build of Keycloak 26.4.12 that address CVE-2026-37979 along with other vulnerabilities. Users should upgrade to Keycloak 26.4.12 as provided by Red Hat Customer Portal to remediate this issue. Before updating, back up existing installations including configurations and databases as recommended by Red Hat. Patch status is confirmed via Red Hat advisories; no alternative workarounds or temporary fixes are indicated.