External Control of Assumed-Immutable Web Parameter in Keycloak - CVE-2026-7571
Published: September 10, 2026
Vulnerability identifier: #VU148948
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-7571
CWE-ID: CWE-472
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain access tokens and disclose sensitive information.
The vulnerability exists due to external control of assumed-immutable web parameters in the OIDC client data handling during session restart when manipulating client data. A remote user can manipulate client data during a session restart to bypass the control that disables the implicit flow and obtain an access token.
Exploitation requires knowledge of user credentials and a client ID. Access tokens may be exposed in server logs, proxy logs, and HTTP Referrer headers.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2026-7571
Install security update from vendor's website.
Keycloak - update to 26.6.2
Red Hat build of Keycloak - update to 26.4.12
Red Hat build of Keycloak - update to 26.4.12