CVE-2026-37977: 
Java vulnerability analysis and mitigation

CVE-2026-37977 is a CORS header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint, classified as an information disclosure flaw. It affects the Maven package org.keycloak:keycloak-services in versions up to and including 26.5.7, as well as Red Hat's build of Keycloak. The vulnerability was published on April 6, 2026, and is tracked under GHSA-5v8v-xvjv-57x7. The CVSS v3.1 base score is 5.3 (Medium) per NVD, while Red Hat's own assessment assigns it 3.7 (Low) (Red Hat Advisory, GitHub Advisory).

The root cause is an Origin Validation Error (CWE-346) in Keycloak's CIBA/UMA grant processing code (org.keycloak.protocol.oidc.grants.ciba). Specifically, the azp (authorized party) claim from a client-supplied JWT is read and used to populate the Access-Control-Allow-Origin response header before the JWT's signature is cryptographically validated. An attacker can craft a JWT with an arbitrary azp value, submit it to the UMA token endpoint, and have that value reflected in the CORS header of the error response — even though the grant is ultimately rejected. Exploitation requires no authentication and no user interaction, but is only effective when the target Keycloak client is misconfigured with webOrigins: ["*"] (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows a remote, unauthenticated attacker to read cross-origin error responses from Keycloak's authorization server, bypassing browser same-origin policy protections. The impact is limited to low-sensitivity information disclosure from UMA error responses (e.g., error codes or messages), with no integrity or availability impact. The vulnerability weakens origin isolation but does not enable account takeover, token theft, or lateral movement on its own (Red Hat Advisory, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-37977. The EPSS score is approximately 0.007–0.009%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement that the target client must be misconfigured with a wildcard webOrigins setting (GitHub Advisory, Red Hat Advisory).

1. Identify a vulnerable target: Locate a Keycloak instance running org.keycloak:keycloak-services version ≤ 26.5.7 where at least one client is configured with webOrigins: ["*"].
2. Craft a malicious JWT: Construct a JWT with an attacker-controlled azp claim set to the desired origin (e.g., https://attacker.example.com). The JWT does not need a valid signature for this step to have effect.
3. Submit to the UMA token endpoint: Send an HTTP POST request to Keycloak's UMA token endpoint (e.g., /realms/{realm}/protocol/openid-connect/token) including the crafted JWT as the client assertion.
4. Observe reflected CORS header: Keycloak reads the azp claim before signature validation and sets Access-Control-Allow-Origin: https://attacker.example.com in the error response.
5. Read cross-origin error response: From a malicious web page hosted at https://attacker.example.com, use JavaScript (e.g., fetch()) to send the crafted request and read the UMA error response body, which would normally be blocked by the browser's same-origin policy (Red Hat Bugzilla, GitHub Advisory).

• Network: Unusual POST requests to the Keycloak UMA token endpoint (/realms/{realm}/protocol/openid-connect/token) containing JWT client assertions with unexpected or external azp claim values; responses with Access-Control-Allow-Origin headers set to unrecognized external origins.
• Logs: Keycloak server logs showing repeated failed UMA grant attempts from the same source IP with varying azp values in the JWT payload; error responses to the UMA endpoint with CORS headers reflecting attacker-controlled origins.
• Configuration: Keycloak client configurations with webOrigins: ["*"] present in the realm — this is a prerequisite for exploitation and should be audited proactively.

The primary remediation is to upgrade org.keycloak:keycloak-services to a version beyond 26.5.7; Keycloak 26.6.3 has been released and addresses this issue (Keycloak Release). Red Hat has issued security errata RHSA-2026:25097 and RHSA-2026:25098 for affected Red Hat build of Keycloak products (Red Hat Errata 25097, Red Hat Errata 25098). As an immediate workaround, administrators should audit all Keycloak client configurations and replace webOrigins: ["*"] with explicit, allowlisted origin values — this eliminates the precondition required for exploitation (Red Hat Bugzilla).

The vulnerability received routine coverage from automated CVE tracking services and security aggregators shortly after disclosure on April 6, 2026. Red Hat, as the reporting CNA, assigned a Low severity rating (3.7), while NVD's enrichment process elevated it to Medium (5.3), reflecting a minor scoring disagreement. No notable independent researcher commentary or significant media coverage has been identified beyond standard vulnerability database entries (Red Hat Advisory, GitHub Advisory).