EUVD-2026-51485
GHSA-wmhp-w67v-6jm5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
AV:N because the token exchange endpoint is network-accessible; PR:L because any Google account (freely obtainable) is required; C:H/I:H for full realm access; A:N as availability is unaffected.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.
AnalysisAI
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account holder - regardless of their domain - to swap a Google OAuth token for a Keycloak realm token and gain unauthorized access. Affected deployments are those specifically configured to restrict Google-based logins to approved Workspace domains while also having token exchange enabled; both conditions must be present. No public exploit code has been identified at time of analysis, and EPSS sits at 0.20% (10th percentile), consistent with SSVC's exploitation status of 'none', though SSVC rates technical impact as 'total' given that successful exploitation delivers full realm access.
Technical ContextAI
Keycloak (cpe:2.3:a:red_hat:red_hat_build_of_keycloak) implements Google as a social identity provider and exposes a token exchange endpoint - an OAuth 2.0 extension that allows clients to present an external identity token (here, a Google OAuth token) and receive a Keycloak-issued session token in return. Administrators can configure the Google IdP to restrict logins to users belonging to specific Google Workspace domains (e.g., only @company.com). The root cause is CWE-862 (Missing Authorization): the authorization guard that enforces those domain restrictions is applied during the standard interactive login flow but is absent in the token exchange code path. Because Google accounts are freely obtainable, the privilege bar (CVSS PR:L) is low - any attacker with a Google account from any domain can trigger the flaw. Red Hat also lists Red Hat Data Grid 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign-On 7 as affected, reflecting Keycloak's role as the underlying identity layer across those products.
RemediationAI
Consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18214 for an updated patch; no exact fixed version number is confirmed in available data at time of analysis. As an immediate compensating control, organizations should disable the Keycloak token exchange feature entirely if it is not required - this directly closes the vulnerable code path with no impact to standard interactive login flows. If token exchange is operationally required, consider restricting access to the token exchange endpoint at the network or reverse-proxy layer to trusted internal clients only, accepting the trade-off that external service-to-service token exchange flows will be broken. A third option is to temporarily remove or disable the Google IdP domain restriction configuration, forcing all Google-authenticated users through normal approval workflows outside Keycloak - this trades the bypass risk for a broader access-control burden. Monitor https://access.redhat.com/security/cve/CVE-2026-18214 for patch availability updates.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today