CVE-2026-105302: Red Hat Build Of Keycloak

Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application, potentially leading to unauthorized access to the user's data on external platforms.

Affected products

• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Single Sign-On 7

Published 2026-10-05. Last modified 2026-10-06.