CVE-2026-19688
Keycloak-services: keycloak-services: admin api missing audience check
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Keycloak-services: keycloak-services: admin api missing audience check
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
- Record
CVE-2026-19688- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-06
EUVDEUVD-2026-117918
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
- Record
EUVD-2026-117918- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-5624-rq7x-6m4q
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution....
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
- Record
GHSA-5624-rq7x-6m4q- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-06
NVD
A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The Admin API fails to verify the intended audience of bearer tokens during authentication. This issue allows an attacker who operates a client within a realm to capture an administrator's access token and reuse it to perform unauthorized administrative actions, potentially leading to full realm compromise.
- Record
CVE-2026-19688- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-06
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List | |
| products, references | CVE List, EUVD, GitHub Advisories, NVD | |
| products, references | CVE List | |
| references | EUVD | |
| published | EUVD | |
| published | EUVD | |
| aliases, published | EUVD | |
| aliases, references | GitHub Advisories | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-19688 is a medium vulnerability (CVSS 6.8) in Red Hat Build Of Keycloak 26.6, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.