Bug 2514534 (CVE-2026-19688)

Summary: CVE-2026-19688 keycloak-services: keycloak-services: Admin API missing audience check
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-11-09   

Description OSIDB Bzimport 2026-08-12 08:59:20 UTC 
A Missing Audience Check vulnerability was identified in the Keycloak Admin REST API. The flaw exists in the AdminRoot.authenticateRealmAdminRequest function, which constructs a BearerTokenAuthenticator without specifying an expected audience. Consequently, the audience validation step in AuthenticationManager.verifyIdentityToken is bypassed. An attacker who operates or compromises a client in a realm can capture an access token from an authenticating administrator (requiring user interaction). If the token contains administrative roles—which is common when the default full scope allowed setting is enabled—the attacker can replay this token against the Admin API. Successful exploitation allows the attacker to perform any action permitted by the captured roles, such as modifying realm configurations, managing users, or deleting resources.