Malformed Content-Type header causes HTTP 500 on token endpoints instead of RFC 6749 §5.2 compliant 400 #49964

Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

authorization-services

Describe the bug

When a malformed Content-Type header is sent to Keycloak's OAuth 2.0 token endpoints, MediaTypeHeaderDelegate.internalParse() in RESTEasy Reactive throws an IllegalArgumentException before the OIDC authentication filter executes. This results in an unauthenticated HTTP 500 Internal Server Error being returned to the client. Per RFC 6749 §5.2, the token endpoint MUST return HTTP 400 with an error parameter (e.g., invalid_request) for malformed requests.

Version

26.6.3

Regression

• The issue is a regression

Expected behavior

Per RFC 6749 §5.2, malformed or unrecognized Content-Type headers sent to the token endpoint should return:

HTTP/1.1 400 Bad Request
Content-Type: application/json
{"error":"invalid_request","error_description":"Invalid Content-Type header"}

The KeycloakSecurityHeadersFilter and OIDC error handling should produce a spec-compliant 400 response regardless of Content-Type parsing failures.

Actual behavior

Three malformed Content-Type variants all produce HTTP 500 with a non-standard response body:

invalid/@@##	
(empty value)	
</><script>alert(1)</script>	

Full response:

HTTP/1.1 500 Internal Server Error
500 - Internal Server Error
---------------------------
Details:
    Error id 207e0c37-e01d-44ac-bb8c-41daa0e54756-5

How to Reproduce?

curl -v -X POST 'http://localhost:8080/realms/master/protocol/openid-connect/token' \
  -H 'Content-Type: invalid/@@##' \
  -d 'grant_type=password&client_id=admin-cli&username=admin&password=admin'

Result: HTTP 500 with Error id body.

Anything else?

No response