CVE-2026-16089CWE-384CWE-472

CVE-2026-16089

Medium · published July 17, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their own client, potentially allowing them to obtain access tokens for a victim's identity.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 20.9th percentile
Weaknesses
CWE-384 · Session Fixation; CWE-472 · External Control of Assumed-Immutable Web Parameter
Published
2026-07-17T19:16Z
Affected products (1)
ProductVersionsFixed in
redhat/build_of_keycloakall versions—
References (4)
https://access.redhat.com/errata/RHSA-2026:68277 · [email protected]https://access.redhat.com/errata/RHSA-2026:68278 · [email protected]https://access.redhat.com/security/cve/CVE-2026-16089 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2501724 · [email protected]
EPSS history
Timeline
  • 17 JUL 14:15Z
    Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session
    cvelistv5