A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.
References
Configurations
No configuration.
History
05 Mar 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Mar 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jan 2026, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-08 04:15
Updated : 2026-04-15 00:35
NVD link : CVE-2026-0707
Mitre link : CVE-2026-0707
CVE.ORG link : CVE-2026-0707
JSON object : View
Products Affected
No product.
CWE
CWE-551
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization