CVE-2026-0707

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-551

Affected software

Vendor	Product	Versions
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4	—
Red Hat	Red Hat build of Keycloak 26.4.10	—

References

Timeline

Published: Jan 8, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-07086.5A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) inp CVE-2026-07097.2Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with CVE-2026-07108.4A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages durin CVE-2026-07116.8A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions through 5.50(ABVY.7.CVE-2026-07146.8A physical attack vulnerability exists in certain Moxa industrial computers using TPM-backed LUKS full-disk encryption on Moxa Industrial Li CVE-2026-07156.8Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An CVE-2026-07164.8A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the m CVE-2026-07175.3The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and CVE-2026-07185.3The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of CVE-2026-07198.6A flaw was identified in the NTLM authentication handling of the libsoup HTTP library, used by GNOME and other applications for network comm CVE-2026-07226.5The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is d CVE-2026-07237.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 th