CVE-2026-19688 · Package
NO FIX YET
The Keycloak Admin REST API does not check the intended audience of bearer tokens during authentication. An attacker who controls a client inside a realm can capture an administrator's access token and reuse it for unauthorized administrative actions, potentially taking over the whole realm.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Keycloak as their identity provider where untrusted or third-party clients can be registered in a realm, since those clients could capture administrator tokens. Deployments where only trusted clients exist in each realm, or where the Admin API is not reachable, are less exposed. The sources do not list affected versions.
Not affected if single-trusted-client-realms
Who cares identity, keycloak, self-hosted
Unknown from the sources.
No fix yet, per the sources.
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.