CVE-2026-16089
5.9
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Exploitability: 1.6 / Impact: 4.2
Source: NVD
Description
A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their own client, potentially allowing them to obtain access tokens for a victim's identity.
Affected (1)
Products: Redhat: Build Of Keycloak
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| All versions |
Related CWEs
CWE-384
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CWE-472
External Control of Assumed-Immutable Web Parameter
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
References (2)
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Timeline
No history available yet.