CVE-2026-16089

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak (affected versions not specified)

Description A flaw in the keycloak-services component occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. This allows an attacker who intercepts an authorization code to modify it so it can be redeemed by their own client, potentially enabling the acquisition of access tokens for a victim's identity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.