Vulnerability-Lookup

CVE-2026-0707 (GCVE-0-2026-0707)

Vulnerability from cvelistv5 – Published: 2026-01-08 03:41 – Updated: 2026-06-08 10:21

Title

Keycloak: keycloak authorization header parsing leading to potential security control bypass

Summary

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-08 15:54 UTC

CWE

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1088 records in the last 180 days details

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:3947	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:3948	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-0707	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2427768	issue-trackingx_refsource_REDHAT
https://github.com/keycloak/keycloak/issues/49433

Impacted products

3 products

Vendor	Product	Version
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4.10-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4-12 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4.10	cpe:/a:redhat:build_keycloak:26.4::el9

Date Public

2026-01-07 00:00

Credits

Red Hat would like to thank Guanping Zhang for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0707",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T15:54:59.827077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-08T15:55:08.627Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4.10",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Guanping Zhang for reporting this issue."
        }
      ],
      "datePublic": "2026-01-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the \"Bearer\" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-551",
              "description": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T10:21:07.875Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:3947",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3947"
        },
        {
          "name": "RHSA-2026:3948",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:3948"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-0707"
        },
        {
          "name": "RHBZ#2427768",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427768"
        },
        {
          "url": "https://github.com/keycloak/keycloak/issues/49433"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-01-08T02:51:20.440Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-01-07T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak: keycloak authorization header parsing leading to potential security control bypass",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, configure any front-end security controls, such as Web Application Firewalls (WAFs) or reverse proxies, to strictly validate and normalize the `Authorization` header before forwarding requests to Keycloak. This ensures that only standard Bearer token formats are processed, preventing potential bypasses."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-0707",
    "datePublished": "2026-01-08T03:41:27.775Z",
    "dateReserved": "2026-01-08T02:52:15.720Z",
    "dateUpdated": "2026-06-08T10:21:07.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-0707",
      "date": "2026-11-04",
      "epss": "0.00403",
      "percentile": "0.3476"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:build_keycloak:26.4::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhbk/keycloak-operator-bundle",
                "product": "Red Hat build of Keycloak 26.4",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "26.4.10-1",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:build_keycloak:26.4::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhbk/keycloak-rhel9",
                "product": "Red Hat build of Keycloak 26.4",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "26.4-12",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:build_keycloak:26.4::el9"
                ],
                "defaultStatus": "affected",
                "packageName": "rhbk/keycloak-rhel9-operator",
                "product": "Red Hat build of Keycloak 26.4",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "26.4-12",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:build_keycloak:26.4::el9"
                ],
                "defaultStatus": "unaffected",
                "packageName": "rhbk/keycloak-rhel9",
                "product": "Red Hat build of Keycloak 26.4.10",
                "vendor": "Red Hat"
              }
            ],
            "source": "secalert@redhat.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the \"Bearer\" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications."
          },
          {
            "lang": "es",
            "value": "Se encontr\u00f3 una vulnerabilidad en Keycloak. El analizador del encabezado de autorizaci\u00f3n de Keycloak es excesivamente permisivo con respecto al formato del esquema de autenticaci\u00f3n \u2019Bearer\u2019. Acepta caracteres no est\u00e1ndar (como tabulaciones) como separadores y tolera variaciones de may\u00fasculas y min\u00fasculas que se desv\u00edan de las especificaciones de la RFC 6750."
          }
        ],
        "id": "CVE-2026-0707",
        "lastModified": "2026-10-26T21:10:00.170",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "secalert@redhat.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-0707",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T15:54:59.827077Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-08T04:15:56.520",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2026:3947"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2026:3948"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/security/cve/CVE-2026-0707"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427768"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://github.com/keycloak/keycloak/issues/49433"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-551"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T13:57:42+00:00",
      "cve": "CVE-2026-0707",
      "id": "CVE-2026-0707",
      "initial_release_date": "2026-01-07T00:00:00+00:00",
      "product_status:fixed": "10",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "keycloak: Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0707.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-0707",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-08T15:54:59.827077Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-08T15:55:04.859Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:build_keycloak:26.4::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhbk/keycloak-operator-bundle",
              "product": "Red Hat build of Keycloak 26.4",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "26.4.10-1",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:build_keycloak:26.4::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhbk/keycloak-rhel9",
              "product": "Red Hat build of Keycloak 26.4",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "26.4-12",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:build_keycloak:26.4::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhbk/keycloak-rhel9-operator",
              "product": "Red Hat build of Keycloak 26.4",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "26.4-12",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:build_keycloak:26.4::el9"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhbk/keycloak-rhel9",
              "product": "Red Hat build of Keycloak 26.4.10",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Guanping Zhang for reporting this issue."
            }
          ],
          "datePublic": "2026-01-07T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the \"Bearer\" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-551",
                  "description": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-08T10:21:07.875Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "name": "RHSA-2026:3947",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2026:3947"
            },
            {
              "name": "RHSA-2026:3948",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2026:3948"
            },
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-0707"
            },
            {
              "name": "RHBZ#2427768",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427768"
            },
            {
              "url": "https://github.com/keycloak/keycloak/issues/49433"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-01-08T02:51:20.440Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-01-07T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Keycloak: keycloak authorization header parsing leading to potential security control bypass",
          "workarounds": [
            {
              "lang": "en",
              "value": "To mitigate this issue, configure any front-end security controls, such as Web Application Firewalls (WAFs) or reverse proxies, to strictly validate and normalize the `Authorization` header before forwarding requests to Keycloak. This ensures that only standard Bearer token formats are processed, preventing potential bypasses."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-0707",
        "datePublished": "2026-01-08T03:41:27.775Z",
        "dateReserved": "2026-01-08T02:52:15.720Z",
        "dateUpdated": "2026-06-08T10:21:07.875Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-0707

Vulnerability from fkie_nvd - Published: 2026-01-08 04:15 - Updated: 2026-10-26 21:10

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:3947
	secalert@redhat.com	https://access.redhat.com/errata/RHSA-2026:3948
	secalert@redhat.com	https://access.redhat.com/security/cve/CVE-2026-0707
	secalert@redhat.com	https://bugzilla.redhat.com/show_bug.cgi?id=2427768
	secalert@redhat.com	https://github.com/keycloak/keycloak/issues/49433

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4.10-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4.10",
          "vendor": "Red Hat"
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the \"Bearer\" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una vulnerabilidad en Keycloak. El analizador del encabezado de autorizaci\u00f3n de Keycloak es excesivamente permisivo con respecto al formato del esquema de autenticaci\u00f3n \u2019Bearer\u2019. Acepta caracteres no est\u00e1ndar (como tabulaciones) como separadores y tolera variaciones de may\u00fasculas y min\u00fasculas que se desv\u00edan de las especificaciones de la RFC 6750."
    }
  ],
  "id": "CVE-2026-0707",
  "lastModified": "2026-10-26T21:10:00.170",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-0707",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-08T15:54:59.827077Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-08T04:15:56.520",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:3947"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2026:3948"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2026-0707"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427768"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/keycloak/keycloak/issues/49433"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-551"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GV94-WP4H-VV8P

Vulnerability from github – Published: 2026-01-08 06:31 – Updated: 2026-06-09 11:58

Summary

Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-parent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.5.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-0707"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-551"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-08T21:14:12Z",
    "nvd_published_at": "2026-01-08T04:15:56Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the \"Bearer\" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.",
  "id": "GHSA-gv94-wp4h-vv8p",
  "modified": "2026-06-09T11:58:24Z",
  "published": "2026-01-08T06:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0707"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/issues/49433"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:3947"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:3948"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-0707"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427768"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
}

JVNDB-2026-026852

Vulnerability from jvndb - Published: 2026-08-05 01:11 - Updated:2026-08-05 01:11

Summary

Multiple Vulnerabilities in Hitachi Ops Center Common Services

Details

Multiple vulnerabilities exist in Hitachi Ops Center Common Services. CVE-2025-10939, CVE-2025-11537, CVE-2025-11538, CVE-2025-12110, CVE-2025-13467, CVE-2025-13881, CVE-2025-14082, CVE-2025-14083, CVE-2025-14777, CVE-2025-66560, CVE-2026-0707, CVE-2026-0871, CVE-2026-0976, CVE-2026-1035, CVE-2026-1190, CVE-2026-2092, CVE-2026-2575, CVE-2026-2673, CVE-2026-3009, CVE-2026-3121, CVE-2026-3429, CVE-2026-3872, CVE-2026-3911, CVE-2026-4282, CVE-2026-4325, CVE-2026-4634, CVE-2026-22745, CVE-2026-22748, CVE-2026-25854, CVE-2026-40972, CVE-2026-40975

References

Type

URL

	CVE	https://www.cve.org/CVERecord?id=CVE-2025-10939
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-11537
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-11538
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-12110
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-13467
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-13881
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-14082
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-14083
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-14777
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-66560
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-0707
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-0871
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-0976
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-1035
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-1190
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-2092
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-22745
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-22748
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-2575
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-25854
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-2673
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3009
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3121
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3429
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3872
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-3911
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-40972
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-40975
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-4282
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-4325
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-4634

Impacted products

Vendor

Product

Hitachi, Ltd

Hitachi Ops Center Common Services

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026852.html",
  "dc:date": "2026-08-05T10:11+09:00",
  "dcterms:issued": "2026-08-05T10:11+09:00",
  "dcterms:modified": "2026-08-05T10:11+09:00",
  "description": "Multiple vulnerabilities exist in Hitachi Ops Center Common Services.\r\n\r\nCVE-2025-10939, CVE-2025-11537, CVE-2025-11538, CVE-2025-12110, CVE-2025-13467, CVE-2025-13881, CVE-2025-14082, CVE-2025-14083, CVE-2025-14777, CVE-2025-66560, CVE-2026-0707, CVE-2026-0871, CVE-2026-0976, CVE-2026-1035, CVE-2026-1190, CVE-2026-2092, CVE-2026-2575, CVE-2026-2673, CVE-2026-3009, CVE-2026-3121, CVE-2026-3429, CVE-2026-3872, CVE-2026-3911, CVE-2026-4282, CVE-2026-4325, CVE-2026-4634, CVE-2026-22745, CVE-2026-22748, CVE-2026-25854, CVE-2026-40972, CVE-2026-40975",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-026852.html",
  "sec:cpe": {
    "#text": "cpe:/a:hitachi:ops_center_common_services",
    "@product": "Hitachi Ops Center Common Services",
    "@vendor": "Hitachi, Ltd",
    "@version": "2.2"
  },
  "sec:identifier": "JVNDB-2026-026852",
  "sec:references": [
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-10939",
      "@id": "CVE-2025-10939",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-11537",
      "@id": "CVE-2025-11537",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-11538",
      "@id": "CVE-2025-11538",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-12110",
      "@id": "CVE-2025-12110",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-13467",
      "@id": "CVE-2025-13467",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-13881",
      "@id": "CVE-2025-13881",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-14082",
      "@id": "CVE-2025-14082",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-14083",
      "@id": "CVE-2025-14083",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-14777",
      "@id": "CVE-2025-14777",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-66560",
      "@id": "CVE-2025-66560",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-0707",
      "@id": "CVE-2026-0707",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-0871",
      "@id": "CVE-2026-0871",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-0976",
      "@id": "CVE-2026-0976",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-1035",
      "@id": "CVE-2026-1035",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-1190",
      "@id": "CVE-2026-1190",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-2092",
      "@id": "CVE-2026-2092",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-22745",
      "@id": "CVE-2026-22745",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-22748",
      "@id": "CVE-2026-22748",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-2575",
      "@id": "CVE-2026-2575",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-25854",
      "@id": "CVE-2026-25854",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-2673",
      "@id": "CVE-2026-2673",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3009",
      "@id": "CVE-2026-3009",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3121",
      "@id": "CVE-2026-3121",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3429",
      "@id": "CVE-2026-3429",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3872",
      "@id": "CVE-2026-3872",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-3911",
      "@id": "CVE-2026-3911",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-40972",
      "@id": "CVE-2026-40972",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-40975",
      "@id": "CVE-2026-40975",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-4282",
      "@id": "CVE-2026-4282",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-4325",
      "@id": "CVE-2026-4325",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-4634",
      "@id": "CVE-2026-4634",
      "@source": "CVE"
    }
  ],
  "title": "Multiple Vulnerabilities in Hitachi Ops Center Common Services"
}

RHSA-2026:3947

Vulnerability from csaf_redhat - Published: 2026-03-05 19:07 - Updated: 2026-10-06 17:28

Summary

Red Hat Security Advisory: Red Hat build of Keycloak 26.4.10 Update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-0707.

CVE-2026-0707

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2026:3947

Open the full advisory

RHSA-2026:3948

Vulnerability from csaf_redhat - Published: 2026-03-05 19:09 - Updated: 2026-10-06 17:28

Summary

Red Hat Security Advisory: Red Hat build of Keycloak 26.4.10 Images Update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-0707.

CVE-2026-0707

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Fixed: 9 products

https://access.redhat.com/errata/RHSA-2026:3948

Open the full advisory

WID-SEC-W-2026-0034

Vulnerability from csaf_certbund - Published: 2026-01-07 23:00 - Updated: 2026-06-04 22:00

Summary

Keycloak: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2026-0707.

CVE-2026-0707

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-0707 (GCVE-0-2026-0707)

FKIE_CVE-2026-0707

GHSA-GV94-WP4H-VV8P

JVNDB-2026-026852

RHSA-2026:3947

RHSA-2026:3948

WID-SEC-W-2026-0034

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour