CVE-2026-37977 Build of Keycloak
| Affected software | Build of Keycloak |
|---|---|
| Severity | 5.3 Medium CVSS 3.1 2 scores |
| Fixed in | 26.4.13, 26.6.3 |
| Weakness | CWE-346 |
| Published | 6 Apr 2026 |
| Updated | 26 Oct 2026 |
Description
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token (JWT) is used to set the Access-Control-Allow-Origin header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled azp value is processed, this value is reflected as the CORS origin, even if the grant is later rejected. This can lead to the exposure of low-sensitivity information from authorization server error responses, weakening origin isolation, but only when a target client is misconfigured with webOrigins: ["*"].
Exploitation status
No public exploit
No exploit has been reported in the sources we check.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 0.26% chance in 30 days
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
A public code fix exists: keycloak/keycloak #49512.
- Protection none
- Action unverified
- Review automated Upstream data
- Record active
| Decided by | Medium or Low severity, no CISA or VulnCheck KEV listing, no PoC clearing the evidence bar, no CISA verdict, no Oracle advisory |
|---|---|
| Finding | This CVE is MEDIUM severity, is not listed in CISA KEV or VulnCheck KEV, has no public exploit or PoC in any indexed source, carries no CISA Vulnrichment finding of a demonstrated exploit, and is not part of an Oracle Critical Patch Update. None of the signals that would put it in front of an engineer is present, and the volume of CVEs below that bar is too great to take one at a time, so no rule is written for it. This is a decision about what we act on, not a finding that the CVE is harmless — a patch may well be derivable, and a low-severity defect can still be one link in a longer chain. |
| Candidate fix | https://bugzilla.redhat.com/show_bug.cgi?id=2455324 : a Red Hat bug: the triage, which links onward to the fix |
CVSS
5.3 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2 metrics
CVSS
5.3 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
NVD | Primary | published |
| CVSS 3.1 | 3.7 | LOW | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
secalert@redhat.com | Secondary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.keycloak:keycloak-services |
0 | 26.4.13 |
unbounded |
org.keycloak:keycloak-services |
26.5.0 | 26.6.3 |
unbounded |
Products and versions
2 products, 3 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| osv | org.keycloak | keycloak-services | generic | ＜ 26.4.13 · ≥ 26.5.0 and ＜ 26.6.3 |
| nvd | redhat | build of keycloak | generic | any version |
References
Timeline
Timeline
| Published | 2026-04-06 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-26 | NVD's own last-modified date for this record. |