Keycloak 26.4.0 <= 26.8.0 Token Introspection Audience Bypass (CVE-2026-105306)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(363811);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/07");

  script_cve_id("CVE-2026-105306");

  script_name(english:"Keycloak 26.4.0 <= 26.8.0 Token Introspection Audience Bypass (CVE-2026-105306)");

  script_set_attribute(attribute:"synopsis", value:
"An identity and access management application running on the remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Keycloak installed on the remote host is 26.4.0 through 26.8.0. It is, therefore, affected by a token
introspection audience bypass vulnerability. An attacker able to use dynamic client registration can register a client
that passes token introspection for tokens that were not issued for it, bypassing the intended audience restriction.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2026-105306");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.redhat.com/show_bug.cgi?id=2545802");
  script_set_attribute(attribute:"see_also", value:"https://github.com/keycloak/keycloak/issues/53549");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-q5jp-7g4g-ch69");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory for patch or mitigation information.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-105306");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:keycloak:keycloak");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("keycloak_nix_installed.nbin");
  script_require_keys("Host/local_checks_enabled", "Host/uname", "installed_sw/Keycloak");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Keycloak', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '26.4.0', 'max_version': '26.8.0', 'fixed_display': 'See vendor advisory'}
      ]
    }
  ]
};

var res = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:res);