CVE-2026-0707

Jan. 8, 2026, 6:08 p.m.

5.3
Medium

Description

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.

Product(s) Impacted

Vendor Product Versions
Redhat
  • Keycloak
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-551
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a redhat keycloak / / / / / / / /

References

https://access.redhat.com/security/cve/CVE-2026-0707
https://bugzilla.redhat.com/show_bug.cgi?id=2427768

Tags

secalert@redhat.com
2026-01-08
CVE-2026-0707
CWE-551

CVSS Score

5.3 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

    View Vector String

Timeline

Published: Jan. 8, 2026, 4:15 a.m.
Last Modified: Jan. 8, 2026, 6:08 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.