SAML Protocol Flaw in Keycloak Affects Open-Source Identity Management
CVE-2026-18217

3.4LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Data Grid 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-on 7
Vendor
CVE Published:
31 July 2026

What is CVE-2026-18217?

A vulnerability exists within the SAML protocol implementation of Keycloak, allowing attackers to exploit configurations with wildcard redirect URLs. This flaw enables an attacker to craft a malicious SAML authentication request. When a legitimate user attempts to log in, Keycloak appends its valid response to these malicious parameters, which may mislead service providers to process incorrect data. Consequently, this could result in users mistakenly gaining access to unauthorized accounts.

References

https://access.redhat.com/security/cve/CVE-2026-18217
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2508311
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank yd1ng for reporting this issue.
.