{"id":"CVE-2026-19688","kind":"vulnerability","aliases":["CVE-2026-19688"],"related":[],"title":"Keycloak: Admin REST API accepts bearer tokens meant for other audiences","description":"A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.","summary":"The Keycloak Admin REST API does not check the intended audience of bearer tokens during authentication. An attacker who controls a client inside a realm can capture an administrator's access token and reuse it for unauthorized administrative actions, potentially taking over the whole realm.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","keycloak","package","self-hosted"],"not_affected_if":["single-trusted-client-realms"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T06:16:42+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:31+00:00","updated_at":"2026-11-06T06:41:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:41:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: Admin REST API accepts bearer tokens meant for other audiences","impact":"high","summary":"The Keycloak Admin REST API does not check the intended audience of bearer tokens during authentication. An attacker who controls a client inside a realm can capture an administrator's access token and reuse it for unauthorized administrative actions, potentially taking over the whole realm.","audience":"businesses","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker takes administrator token and gains full realm control","analyst_note":"Find affected and fixed Keycloak versions and the audience-check fix from the NVD entry or the Keycloak project advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-19688).","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["single-trusted-client-realms"],"who_is_affected":"Organizations running Keycloak as their identity provider where untrusted or third-party clients can be registered in a realm, since those clients could capture administrator tokens. Deployments where only trusted clients exist in each realm, or where the Admin API is not reachable, are less exposed. The sources do not list affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4234,"output_tokens":512,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-19688':14A,17A '-2026':13A,16A 'accept':5A 'access':54B,83C,117C 'action':62B,126C 'admin':2A,26B,75C,87C 'administr':52B,61B,115C,125C 'allow':102C 'api':4A,28B,77C,88C 'attack':41B,104C 'audienc':11A,34B,94C 'authent':39B,99C 'bearer':6A,36B,96C 'captur':50B,113C 'check':31B 'client':45B,108C 'compromis':132C 'control':43B 'cve':12A,15A 'fail':89C 'flaw':70C 'found':72C 'full':130C 'host':23B 'ident':18B,81C 'insid':46B 'intend':33B,93C 'issu':101C 'keycloak':1A,19B,25B,79C 'lead':128C 'manag':84C 'meant':8A 'oper':106C 'packag':20B 'perform':123C 'potenti':63B,127C 'realm':48B,68B,111C,131C 'rest':3A,27B,76C 'reus':57B,120C 'self':22B 'self-host':21B 'solut':85C 'take':64B 'token':7A,37B,55B,97C,118C 'unauthor':60B,124C 'verifi':91C 'whole':67B 'within':109C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Keycloak as their identity provider where untrusted or third-party clients can be registered in a realm, since those clients could capture administrator tokens. Deployments where only trusted clients exist in each realm, or where the Admin API is not reachable, are less exposed. The sources do not list affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","keycloak","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-19688':14A,17A '-2026':13A,16A 'accept':5A 'admin':2A 'api':4A 'audienc':11A 'bearer':6A 'cve':12A,15A 'keycloak':1A 'meant':8A 'rest':3A 'token':7A","search_b":"'access':54B 'action':62B 'admin':26B 'administr':52B,61B 'api':28B 'attack':41B 'audienc':34B 'authent':39B 'bearer':36B 'captur':50B 'check':31B 'client':45B 'control':43B 'host':23B 'ident':18B 'insid':46B 'intend':33B 'keycloak':19B,25B 'packag':20B 'potenti':63B 'realm':48B,68B 'rest':27B 'reus':57B 'self':22B 'self-host':21B 'take':64B 'token':37B,55B 'unauthor':60B 'whole':67B","search_c":"'access':83C,117C 'action':126C 'admin':75C,87C 'administr':115C,125C 'allow':102C 'api':77C,88C 'attack':104C 'audienc':94C 'authent':99C 'bearer':96C 'captur':113C 'client':108C 'compromis':132C 'fail':89C 'flaw':70C 'found':72C 'full':130C 'ident':81C 'intend':93C 'issu':101C 'keycloak':79C 'lead':128C 'manag':84C 'oper':106C 'perform':123C 'potenti':127C 'realm':111C,131C 'rest':76C 'reus':120C 'solut':85C 'token':97C,118C 'unauthor':124C 'verifi':91C 'within':109C","first_public_at":"2026-11-06T06:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19688","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19688","severity":null,"published_at":"2026-11-06T06:16:42+00:00","modified_at":"2026-11-06T06:16:42+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}