This vulnerability in Red Hat build of Keycloak 26.4 allows a low-privilege user, who knows user credentials and client ID, to bypass the intended disabling of the implicit flow in OpenID Connect clients. The attacker achieves this by forging client data during a session restart, thereby obtaining access tokens that should not be accessible. Additionally, these tokens can be inadvertently exposed in various logs and HTTP Referrer headers, causing sensitive information disclosure. The issue is tracked as CVE-2026-7571 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Red Hat has published security advisories and released Keycloak 26.4.12 packages that include fixes for this vulnerability.

Successful exploitation allows a low-privilege attacker to bypass security controls disabling the implicit flow in OIDC clients, resulting in unauthorized access token disclosure. This can lead to sensitive information exposure through logs and HTTP headers. The confidentiality impact is high, integrity impact is low, and availability is not affected. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for Red Hat build of Keycloak version 26.4.12 that address CVE-2026-7571 along with other vulnerabilities. Users should back up their existing installations and apply the official update from the Red Hat Customer Portal. No temporary or alternative mitigations are documented; applying the official patch is the recommended remediation.