CVE-2026-0707 — Keycloak: keycloak authorization header parsing leading to potential security control bypass
A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standa…
Published: 2026-01-08 · CVSS: 5.3 · CVSS 3.1
A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7