CVE-2026-19688

A flaw exists in the Admin REST API of Keycloak , an identity and access management solution, where the API fails to verify the intended audience of bearer tokens during authentication. An attacker operating a client within a realm can capture an administrator's access token and reuse it to perfo...