Keycloak contains a flaw that allows a low‑privilege user, who knows a user’s credentials and a client ID, to bypass the control that disables implicit flow in OIDC clients. By manipulating client data during a session restart, an attacker can obtain an access token that should not be issued and can be exposed through server logs, proxy logs, or HTTP Referrer headers, resulting in sensitive information disclosure. The weakness is a client‑side data validation flaw (CWE-472).

The affected product is Red Hat Build of Keycloak. Version information is not explicitly provided in the advisory, so any deployment of this build may be vulnerable until a patch is released or mitigations are applied.

The CVSS score of 7.1 indicates a high risk, but there is no EPSS data and the vulnerability is not in the CISA KEV catalog. The likely attack vector requires an attacker to control a legitimate user account and know a client ID; it involves manipulating client data when restarting a session. Without mitigation, the attacker can gain unauthorized access tokens and expose them in logs, creating a risk of credential compromise and data leakage.