Keycloak’s Authorization header parser accepted non‑standard separators such as tabs and tolerated case variations that diverge from RFC 6750, allowing crafted Bearer tokens to be accepted. This leads to an authentication bypass that can let an attacker obtain user or administrative access without valid credentials.

The flaw affects Red Hat builds of Keycloak 26.4, including the 26.4.10 update, running on Enterprise Linux 9 platforms.

With a CVSS score of 5.3 and an EPSS score of less than 1 %, the vulnerability is of moderate severity and considered unlikely to be widely exploited, yet it is present in the public domain. An attacker can remotely send a specially formatted Authorization header directly to the Keycloak endpoint to bypass normal bearer token checks. No privileged state or additional conditions are required beyond network access to the service.