CVE-2026-0707

Summary

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat build of Keycloak 26.426.4.10-1 < *unaffected
Red HatRed Hat build of Keycloak 26.426.4-12 < *unaffected
Red HatRed Hat build of Keycloak 26.426.4-12 < *unaffected

Weaknesses

  • CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Workarounds

To mitigate this issue, configure any front-end security controls, such as Web Application Firewalls (WAFs) or reverse proxies, to strictly validate and normalize the Authorization header before forwarding requests to Keycloak. This ensures that only standard Bearer token formats are processed, preventing potential bypasses.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References