A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the Bearer authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.
Weakness
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-operator-bundle:26.4.10-1 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-rhel9:26.4-12 | * |
| Red Hat build of Keycloak 26.4 | RedHat | rhbk/keycloak-rhel9-operator:26.4-12 | * |
| Red Hat build of Keycloak 26.4.10 | RedHat | rhbk/keycloak-rhel9 | * |