Authentication Flow Vulnerability in Keycloak by Red Hat
CVE-2026-18209

3.4LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Data Grid 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-on 7
Vendor
CVE Published:
31 July 2026

What is CVE-2026-18209?

A flaw exists in the keycloak-services component of Keycloak, concerning OpenID Connect (OIDC) authentication flows. This vulnerability arises due to the inadequate security check on redirect URLs, specifically neglecting the fragment portion while only inspecting the query section. As a result, if a client uses a wildcard redirect URI, an attacker could inject duplicate security parameters into the login response. When client applications have improper configurations, they may mistakenly trust the attacker's maliciously injected data over the legitimate security information provided by Keycloak, risking session fixation or user account issues.

References

https://access.redhat.com/security/cve/CVE-2026-18209
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2508305
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank default-cybe for reporting this issue.
.