CVE-2026-0707
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Jan 8, 2026
CISA due date
—
The record
A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.keycloak:keycloak-parent | 0 | No fix |
Related vulnerabilities
- GHSA-gv94-wp4h-vv8p Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization Same vulnerability
- GHSA-fwhw-chw4-gh37 Keycloak Server-Side Request Forgery (SSRF) vulnerability Also affects org.keycloak:keycloak-parent
- CVE-2026-1518 A flaw was found in Keycloak’s CIBA feature where insufficient validation of… Also affects org.keycloak:keycloak-parent
- CVE-2026-106579 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-551
- CVE-2026-16102 A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an… CWE-551
- CVE-2026-15573 A flaw was found in Keycloak's Authorization Services. CWE-551
- CVE-2026-13676 fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN)… CWE-551
- CVE-2026-57920 Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass… CWE-551