EUVD-2026-51480
GHSA-v8h5-7wp9-qxxv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-exploitable via token exchange API; PR:L reflects mandatory valid Microsoft token prerequisite; no availability impact as exploitation grants access, not disruption.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionNVD
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.
AnalysisAI
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Microsoft OAuth token - even from a completely unrelated Azure AD organization - to authenticate into a Keycloak realm via the token exchange feature. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and Red Hat JBoss EAP Expansion Pack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three simultaneous conditions: (1) the Keycloak realm must be configured with a Microsoft identity provider that has a specific-tenant restriction enabled (i.e., the 'Tenant' field in the Microsoft IdP configuration is set to a specific Azure AD organization rather than 'organizations' or 'common'); (2) the Keycloak realm must have the token exchange feature enabled (disabled by default in many configurations and must be explicitly turned on via realm settings); and (3) the attacker must possess any valid Microsoft OAuth token - this can be from a completely different Azure AD organization, including a free tenant the attacker themselves controls. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately captures the network-accessible, low-complexity nature of exploitation, but the PR:L metric is the key qualifying factor: an attacker must possess a valid Microsoft OAuth token from any Azure AD tenant, which is readily obtainable by creating a free Microsoft account or organization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free Microsoft Azure AD tenant and obtains a valid Microsoft OAuth access token for their own account. They then send a token exchange request to the target Keycloak instance's token exchange endpoint, submitting this cross-tenant Microsoft token. … |
| Remediation | The primary remediation is to apply the vendor-released patch per the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-18215; exact fixed versions are not independently confirmed in the available data and should be verified directly against the advisory before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of Keycloak, Single Sign-On 7, and JBoss EAP Expansion Pack using Microsoft identity provider integration; document business criticality and data sensitivity of affected applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today