Missing Authorization

Keycloak is vulnerable to Missing Authorization. The vulnerability is due to improper filtering of token claims in signed JWT introspection responses for tokens issued to a different audience, which allows an unauthorized client to bypass audience restrictions and access sensitive token informati...