CVE-2026-18208: Keycloak Information Disclosure Flaw

CVE-2026-18208 Overview

CVE-2026-18208 is an information disclosure vulnerability in the OpenID Connect (OIDC) token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management (IAM) platform used to secure applications and services. The flaw appears when a confidential client configured for signed JSON Web Token (JWT) introspection responses submits a token issued for a different audience. The endpoint marks the token as inactive but still returns the full set of token claims inside the signed JWT field. An authenticated client can leverage this behavior to bypass audience-based restrictions and read sensitive claims from tokens it should not access [CWE-862].

Critical Impact
Authenticated confidential clients can extract token claims for audiences they are not authorized to introspect, breaking audience isolation in multi-tenant Keycloak deployments.

Affected Products

Red Hat Keycloak keycloak-services component
Red Hat build of Keycloak
Downstream distributions of Keycloak using the affected introspection endpoint

Discovery Timeline

2026-07-31 - CVE-2026-18208 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18208

Vulnerability Analysis

The defect resides in the OIDC token introspection endpoint exposed by keycloak-services. Confidential clients can request introspection responses signed as JWTs instead of plain JSON. When a client introspects a token issued for a different audience, Keycloak correctly evaluates the audience mismatch and returns active: false in the response. However, the signed JWT payload still embeds the complete claim set from the introspected token. The result is that unauthorized clients receive access to claims such as subject identifiers, roles, scopes, and custom attributes that should be restricted to the intended audience.

The vulnerability requires authentication as a confidential client, which limits exploitation to entities already registered in the realm. It does not require user interaction and is exploitable over the network against the standard introspection endpoint.

Root Cause

The root cause is missing authorization on the claim payload path that constructs signed JWT introspection responses [CWE-862]. The endpoint enforces the audience check only on the active field but fails to strip or suppress token claims when the requesting client is not part of the token audience. Signed JWT introspection responses therefore leak data that the plain JSON path would not expose.

Attack Vector

An attacker who controls a confidential client in the same Keycloak realm captures or obtains a token issued for another audience. The attacker sends this token to the /protocol/openid-connect/token/introspect endpoint using their own client credentials and requests a signed JWT response via the Accept: application/token-introspection+jwt content negotiation. Keycloak returns a signed JWT whose payload contains the full claim set of the target token, even though the top-level active flag reports false. The attacker parses the JWT and extracts identity data, roles, and custom claims. See the Red Hat CVE-2026-18208 Advisory and Red Hat Bug Report #2508304 for vendor detail.

Detection Methods for CVE-2026-18208

Indicators of Compromise

Introspection requests from confidential clients with Accept: application/token-introspection+jwt targeting tokens whose audience does not include the requesting client
Repeated introspection calls from a single client against tokens issued for many different audiences
Elevated volume of active=false responses paired with signed JWT payloads in Keycloak access logs

Detection Strategies

Correlate Keycloak event logs for TOKEN_INTROSPECT events with the requesting client_id and the aud claim of the introspected token to flag audience mismatches
Alert on any confidential client that introspects tokens outside its expected audience scope over a rolling window
Inspect reverse proxy logs for anomalous Accept headers requesting signed JWT introspection responses from clients that historically used JSON

Monitoring Recommendations

Forward Keycloak admin and event logs to a centralized analytics platform with retention sufficient for audit review
Baseline introspection traffic per client and alert on deviations in request volume, target audiences, or response format
Track configuration changes to client settings that enable signed JWT introspection responses

How to Mitigate CVE-2026-18208

Immediate Actions Required

Apply the Keycloak security update referenced in the Red Hat CVE-2026-18208 Advisory as soon as it is available for your distribution
Audit all confidential clients configured to receive signed JWT introspection responses and disable the setting where it is not required
Rotate tokens and credentials that may have been exposed through the introspection endpoint during the exposure window

Patch Information

Refer to the Red Hat CVE-2026-18208 Advisory and Red Hat Bug Report #2508304 for fixed versions and errata. Upstream Keycloak fixes should be tracked through the corresponding Keycloak release notes for the keycloak-services component.

Workarounds

Set introspection response type to plain JSON for confidential clients by clearing the signed JWT introspection response signature algorithm in the client configuration
Restrict which clients are permitted to call the token introspection endpoint using realm-level access policies or an upstream API gateway
Enforce strict audience scoping so tokens are issued only to clients that legitimately require introspection access

bash

# Disable signed JWT introspection responses for a confidential client via kcadm
kcadm.sh update clients/<client-uuid> -r <realm> \
  -s 'attributes."token.introspection.signed.response.alg"=""'