This vulnerability in Red Hat Build of Keycloak involves external control of an assumed-immutable web parameter. A low-privilege attacker with knowledge of user credentials and client ID can manipulate client data during session restart to bypass restrictions on the implicit flow in OpenID Connect clients. This results in unauthorized access token issuance and potential exposure of these tokens in various logs and HTTP headers. The issue affects the security of access tokens and could lead to sensitive information disclosure. The CVSS 3.1 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory does not currently confirm patch availability or remediation status.

An attacker with low privileges and knowledge of user credentials and client ID can bypass intended security controls to obtain access tokens that should be unavailable. These tokens may be exposed in server logs, proxy logs, and HTTP Referrer headers, potentially leading to sensitive information disclosure. The vulnerability impacts confidentiality significantly but has limited impact on integrity and no impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-7571 for current remediation guidance. Until a fix is available, restrict access to logs that may contain sensitive tokens and monitor for unusual token issuance patterns. Avoid relying solely on disabling implicit flow controls as a security measure. Follow vendor updates closely for official patches or mitigations.