Token Exchange Vulnerability in Keycloak by Red Hat
CVE-2026-18215

6.8MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Data Grid 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-on 7
Vendor
CVE Published:
31 July 2026

What is CVE-2026-18215?

Keycloak allows users to authenticate using Microsoft accounts while restricting access to designated organizations. However, a security flaw enables this restriction to be bypassed during the token exchange process. An attacker possessing a valid Microsoft token, even from an unrelated organization, may gain unforeseen access to sensitive realms within Keycloak. This could lead to unauthorized actions or data exposure, posing significant risks to user and organizational security.

References

https://access.redhat.com/security/cve/CVE-2026-18215
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2508309
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Paul Bottinelli (Trail of Bits) for reporting this issue.
.