CVE-2026-16089: Keycloak Package Vulnerability - Authorization Codes Retargeting Risk
Summary
CVE-2026-16089: Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session. Affects keycloak versions < 26.7.3. Fixed in 26.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that enables secure authentication and authorization for applications and services. It provides features such as single sign-on (SSO), user federation, and identity brokering. The vulnerability in question affects the keycloak-services component, which is responsible for handling OAuth 2.0 authorization codes. This flaw allows an attacker to intercept and manipulate authorization codes, posing a significant security risk.
Vulnerability Detail
A flaw was discovered in the keycloak-services component of Red Hat Build of Keycloak. The vulnerability arises because OAuth 2.0 authorization codes are not securely bound to the client that originally requested them. An attacker capable of intercepting an authorization code can alter it to be redeemed by their own client application. This could lead to unauthorized access tokens being issued for a victim's identity, allowing the attacker to impersonate the victim and access sensitive information.
How To Fix
Minimum fixed version
26.7.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as monitoring for unusual activity related to authorization codes and ensuring that sensitive operations are logged. However, the best approach is to apply the patch as soon as possible.
Conclusion
The CVE-2026-16089 vulnerability in the Keycloak package poses a serious risk by allowing attackers to manipulate OAuth 2.0 authorization codes. It is crucial to update to the patched version 26.7.3 to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for keycloak →
FAQ
CVE-2026-16089 is a vulnerability in the Keycloak package that allows attackers to retarget OAuth 2.0 authorization codes to their own client sessions.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring access to the code.
If exploited, this vulnerability could allow attackers to obtain access tokens for a victim's identity, leading to unauthorized access to sensitive information and services.
Yes, a patch is available in version 26.7.3 of the Keycloak package. It is recommended to update to this version or later.
If immediate updating is not possible, implement additional security measures to monitor for unusual activity and consider applying temporary workarounds until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for keycloak.
