ZeroDay Findings
Sign inSign up

Findings

CVE-2026-37977

A flaw was found in Keycloak.

Published Apr 6, 2026 · updated Jun 26, 2026 · redhat build of keycloak

A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the claim from a client-supplied JSON Web Token (JWT) is used to set the header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled value is processed, this value is reflected as the CORS origin, even if the grant is later rejected. This can lead to the exposure of low-sensitivity information from authorization server error responses, weakening origin isolation, but only when a target client is misconfigured with .

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 6, 2026 · NIST NVD

    Detected

    A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the claim from a client-supplied JSON Web Token (JWT) is used to set the header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled value is proc

  2. Jun 26, 2026 · NIST NVD

    Updated

    A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the claim from a client-supplied JSON Web Token (JWT) is used to set the header before the JWT signature is validated. When a specially crafted JWT with an attacker-controlled value is proc

Affected

  • cpe redhat/build of keycloakversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-37977

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-37977

    A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the claim from a client-supplied JSON Web Token (JWT) is used t

    nvd.nist.gov

References