CVE-2026-37977: Information Disclosure in Keycloak

This vulnerability allows a remote attacker to inject a malicious CORS header by crafting a specially designed JSON Web Token (JWT). The flaw arises because the azp claim within the JWT is used to set the Access-Control-Allow-Origin header before the JWT signature is validated. Even if the grant is subsequently rejected, the attacker-controlled azp value is reflected as the CORS origin, potentially exposing low-sensitivity information. While the CVSS score is LOW, the potential for information leakage, even if limited, warrants immediate attention. This could be leveraged to gather insights into the Keycloak deployment and potentially aid in further attacks.

1. Reserved2026-04-06
2. Published2026-04-06
3. Modified2026-04-24
4. EPSS updated2026-04-13

The primary mitigation is to upgrade Keycloak to version 2.5.4 or later, which contains the fix. As an interim measure, restrict the allowed client origins in Keycloak's configuration to prevent unauthorized requests. Carefully validate JWT signatures before using any claim to set CORS headers. Implement robust input validation to sanitize the azp claim and prevent malicious values from being injected. Review and tighten CORS policies to minimize the potential impact of this vulnerability.