Keycloak Vulnerability CVE-2026-7571 Allows Implicit Flow Bypass

The National Vulnerability Database has detailed a critical flaw, CVE-2026-7571, affecting Keycloak. This vulnerability allows a low-privilege attacker, possessing user credentials and a client ID, to circumvent security measures designed to disable the implicit OpenID Connect flow. By manipulating client data during a session restart, attackers can illicitly obtain access tokens that should be inaccessible.

This bypass is not merely theoretical. The National Vulnerability Database indicates that the compromised access tokens can be inadvertently exposed across various logging systems, including server logs, proxy logs, and even in HTTP Referrer headers. This exposure constitutes a significant sensitive information disclosure risk, potentially granting attackers broader access or enabling further compromise.

Defenders must prioritize patching Keycloak instances immediately. The CVSS score of 7.1 (HIGH) underscores the severity. Organizations should also review access control configurations, especially for OIDC clients, and audit logs for any signs of unusual token acquisition or exposure.