{"id":"CVE-2026-37977","published":"2026-04-06T08:38:36Z","modified":"2026-06-26T07:01:32Z","title":"Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to…","vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","tier":"tail","description":{"text":"A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the `azp` claim from a client-supplied JSON Web Token (JWT) is used to set the `Access-Control-Allow-Origin` header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled `azp` value is processed, this value is reflected as the CORS origin, even if the grant is later rejected. This can lead to the exposure of low-sensitivity information from authorization server error responses, weakening origin isolation, but only when a target client is misconfigured with `webOrigins: [\"*\"]`.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00253,"percentile":0.16795,"provenance":"source"},"cwes":[{"id":"CWE-346","name":"Origin Validation Error"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:25097","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25098","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30049","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30050","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-37977","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455324","tags":["issue-tracking","x_refsource_REDHAT"]}],"priority":{"score":5.9,"factors":[{"name":"EPSS percentile","points":3.36},{"name":"CVSS severity","points":2.59}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.4","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","versions":["all versions"]}],"affected":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-services","vulnerableRanges":["<26.4.13",">=26.5.0, <26.6.3"],"patched":["26.4.13","26.6.3"],"from":["GHSA-5v8v-xvjv-57x7"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-19201","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2026-4633","published":"2026-03-23","fixed":"26.6.1","kev":false,"link":{"from":"CVE-2026-4633","to":"CVE-2026-37977","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"26.4.12","toFixed":"26.4.13","daysApart":14}]}},{"cve":"CVE-2026-7504","published":"2026-05-19","fixed":"26.6.2","kev":false},{"cve":"CVE-2026-7507","published":"2026-05-19","fixed":"26.6.2","kev":false},{"cve":"CVE-2026-7571","published":"2026-05-19","fixed":"26.6.2","kev":false},{"cve":"CVE-2026-37977","published":"2026-04-06","fixed":"26.6.3","kev":false},{"cve":"CVE-2026-4874","published":"2026-03-26","fixed":"26.6.3","kev":false},{"cve":"CVE-2026-8830","published":"2026-05-19","fixed":"26.6.3","kev":false},{"cve":"CVE-2026-9087","published":"2026-05-20","fixed":"26.6.3","kev":false},{"cve":"CVE-2026-18963","published":"2026-08-18","fixed":"26.7.2","kev":false,"link":{"from":"CVE-2026-37977","to":"CVE-2026-18963","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.keycloak:keycloak-services","fromFixed":"26.4.13","toFixed":"26.4.15","daysApart":134}]}}],"package":"Maven:org.keycloak:keycloak-services"}}