---
id: "CVE-2026-19688"
page: "https://infrastack.ai/live/CVE-2026-19688"
kind: "vulnerability"
aliases: ["CVE-2026-19688"]
title: "Keycloak: Admin REST API accepts bearer tokens meant for other audiences"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["identity", "keycloak", "package", "self-hosted"]
not_affected_if: ["single-trusted-client-realms"]
published_at: "2026-11-06T06:16:42+00:00"
first_seen_at: "2026-11-06T06:40:12+00:00"
updated_at: "2026-11-06T06:41:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19688", "first_seen_at": "2026-11-06T06:40:12+00:00"}]
exploit_sources: []
---

# Keycloak: Admin REST API accepts bearer tokens meant for other audiences

Link for people: https://infrastack.ai/live/CVE-2026-19688 (this .md is for agents)

The Keycloak Admin REST API does not check the intended audience of bearer tokens during authentication. An attacker who controls a client inside a realm can capture an administrator's access token and reuse it for unauthorized administrative actions, potentially taking over the whole realm.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T06:40:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19688

## From the sources

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_