What is the CVSS score of CVE-2026-18569?

CVE-2026-18569 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.2%.

Red Hat Keycloak CVE-2026-18569

EUVD-2026-52575 LOW

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-04 redhat

GHSA-pcf4-9g97-7cpf

Information Disclosure Red Hat Jwt Attack Red Hat Build Of Keycloak Red Hat Jboss Enterprise Application Platform Expansion Pack Red Hat Single Sign On 7 Red Hat Data Grid 8 Red Hat

3.7

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

Network-accessible endpoint (AV:N), but requires non-default IDP config and prior session knowledge (AC:H); no auth needed (PR:N); impact is session termination only (A:L), no C or I.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Red Hat

3.7 LOW

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 05:58 vuln.today

DescriptionCVE.org

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.

AnalysisAI

Forced logout via unsigned backchannel requests affects Red Hat Build of Keycloak when an OIDC identity provider is configured to skip signature validation. Under this non-default configuration, the backchannel logout endpoint in keycloak-services improperly accepts logout requests lacking any cryptographic signature (CWE-347), violating the OIDC backchannel logout specification. An unauthenticated network attacker who possesses knowledge of a target user's session identifiers can submit a forged unsigned logout request, terminating that session without the user's consent. No public exploit or active exploitation (CISA KEV) has been identified; with CVSS 3.7 and EPSS data absent from the input, this is a low-priority availability-only issue gated by a specific non-default configuration.

Technical ContextAI

Keycloak is an open-source identity and access management server; the Red Hat Build of Keycloak is Red Hat's supported distribution, also underpinning Red Hat Single Sign-On 7 and integrated with Red Hat JBoss EAP Expansion Pack and Red Hat Data Grid 8 (CPE: cpe:2.3:a:red_hat:red_hat_build_of_keycloak, cpe:2.3:a:red_hat:red_hat_single_sign-on_7, cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_expansion_pack, cpe:2.3:a:red_hat:red_hat_data_grid_8). The backchannel logout endpoint is part of the OIDC specification (RFC 9126 / OpenID Connect Back-Channel Logout 1.0) and allows identity providers to push logout events directly to relying parties without user browser involvement. The keycloak-services component is responsible for processing these inbound logout tokens. CWE-347 (Improper Verification of Cryptographic Signature) is the root cause: when an upstream OIDC identity provider is configured with the 'skip signature validation' option, Keycloak's backchannel logout handler does not enforce that incoming logout JWTs are signed, allowing unsigned tokens to be accepted as legitimate. This is a JWT attack surface - the tags confirm this - where the absence of algorithm enforcement leads to signature bypass.

RemediationAI

The primary remediation is to apply the vendor-supplied patch from Red Hat once available; consult https://access.redhat.com/security/cve/CVE-2026-18569 for the specific erratum and updated package versions, as exact fix version numbers are not confirmed in the current input data. As a compensating control, administrators should audit all configured OIDC identity providers in the Keycloak admin console and disable the 'skip signature validation' option on any IDP where it is currently enabled - this directly eliminates the vulnerable code path and has the trade-off of requiring that the upstream IDP present properly signed tokens, which may break federation with IDPs that do not support JWT signing. If disabling signature skip is not immediately feasible, restricting network access to the backchannel logout endpoint (typically at /auth/realms/{realm}/protocol/openid-connect/logout) to trusted IDP IP ranges via a reverse proxy or firewall rule reduces the attack surface at the cost of breaking logout flows from unexpected network paths. Tracking the Bugzilla issue at https://bugzilla.redhat.com/show_bug.cgi?id=2509755 will provide patch availability updates.