CVE-2026-37979 — Keycloak Vulnerability

title: CVE-2026-37979 - Keycloak OIDC Token Introspection Bypass
id: scw-2026-05-19-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-37979 by targeting the Keycloak OIDC token introspection endpoint. This rule looks for POST requests to the introspection endpoint that may indicate an attempt to bypass audience restrictions and retrieve unauthorized token claims. The presence of 'scope=' in the query string is a common indicator of such requests.
author: SCW Feed Engine (AI-generated)
date: 2026-05-19
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-37979/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/realms/'
      cs-uri|endswith:
          - '/protocol/openid-connect/token/introspect'
      cs-method:
          - 'POST'
      cs-uri-query|contains:
          - 'scope=' # This is a common parameter in introspection requests
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse