CVE-2026-16089: redhat build_of_keycloak
Vulnerability summary
CVE-2026-16089 is a medium (CVSS 5.9) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.6% of scored vulnerabilities.
Timeline
- 17-07-2026PublishedVulnerability first disclosed.
- 16-09-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their own client, potentially allowing them to obtain access tokens for a victim's identity.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:NDiffers
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
+0.12 pp
From 0.18% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-472External Control of Assumed-Immutable Web ParameterThe web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
- CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Affected systems
Redhat1 product
1 vendor · 1 product