8000 Token introspection now validates audience claim. UserInfo endpoint r… by graziang · Pull Request #49131 · keycloak/keycloak · GitHub
[go: up one dir, main page]

Skip to content

Token introspection now validates audience claim. UserInfo endpoint r… - #49131

Merged
mposolda merged 1 commit into
keycloak:mainfrom
graziang:issue-49113
May 20, 2026
Merged

mposolda merged 1 commit into
keycloak:mainfrom
graziang:issue-49113

Conversation

@graziang
Copy link
Copy Markdown
Contributor

…ejects lightweight access tokens.

Closes #49113

@mposolda mposolda self-assigned this May 19, 2026
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@graziang Thanks for the backport! Added just comment inline related to the upgrading guide location.

@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@graziang Is it possible to rebase and fix the conflicts? Otherwise, looks good. Thanks!

@graziang
Copy link
Copy Markdown
Contributor Author

@graziang Is it possible to rebase and fix the conflicts? Otherwise, looks good. Thanks!

I'm trying,

@graziang Is it possible to rebase and fix the conflicts? Otherwise, looks good. Thanks!

I’m trying, but the test framework is alive and evolving 😄, and this pr changes a lot of tests. But we probably need to wait for #49143

@graziang
graziang force-pushed the issue-49113 branch 2 times, most recently from f71b7ed to ad62aa6 Compare May 20, 2026 08:16
…ejects lightweight access tokens.

Closes keycloak#49113

Signed-off-by: Giuseppe Graziano <g.graziano94@gmail.com>
@mposolda mposolda left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@graziang Thanks! Hope to merge once tests are OK.

FYI. Created GH issue to remove backwards compatibility stuff (likely in KC 27): #49168

@mposolda
mposolda merged commit a140566 into keycloak:main May 20, 2026
138 of 144 checks passed
@steinwelberg steinwelberg mentioned this pull request Jun 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens

2 participants

0