This vulnerability exists in Keycloak's OIDC token introspection endpoint, where a confidential client can bypass the audience restrictions. The flaw enables the retrieval of token claims that are intended for other resource servers, thereby leaking sensitive information. As a result, an attacker can compromise the confidentiality of lightweight access tokens, exposing potentially confidential user data or service permissions.

The affected product is Red Hat Build of Keycloak. No specific version range is disclosed, so all installations of this product should be examined for a fix once it becomes available.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so there is no current estimate of exploitation likelihood. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is remote, with the attacker needing valid confidential client credentials within the realm to trigger the exploit.