Skip to main content

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization in org.keycloak:keycloak-services

CVE-2026-0707

  • org.keycloak:keycloak-services
Medium
5.3/10

Summary

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

References

Advisory Timeline

  • Published