EUVD-2026-51487
GHSA-c8xx-fr3x-6m5w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
AC:H reflects dual prerequisite of wildcard redirect URI plus non-compliant client; S:C captures integrity impact landing on the relying party, not Keycloak itself.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
AnalysisAI
Incomplete HTTP parameter pollution validation in Keycloak's keycloak-services component exposes OIDC authentication flows to session fixation and account confusion attacks. The security check inspects only the query string of redirect URLs while ignoring the URL fragment, enabling an attacker to inject duplicate security parameters when a client is configured with a wildcard redirect URI. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions to be true: (1) the OIDC client registered in Keycloak must be configured with a wildcard redirect URI pattern (e.g., using '*' glob matching such as 'https://app.example.com/*'), a configuration explicitly discouraged by the OIDC specification; and (2) the relying-party client application must fail to properly validate OIDC security parameters - specifically trusting attacker-injected state, nonce, or session values delivered via URL fragment rather than those originally issued by Keycloak. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low despite the authentication context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a Keycloak deployment where a client application uses a wildcard redirect URI and determines the client does not properly validate OIDC state or nonce parameters. The attacker crafts a login initiation URL embedding malicious security parameters in the fragment portion of the redirect URI and delivers it to a victim via phishing or a malicious link, inducing the victim to authenticate through Keycloak. … |
| Remediation | Apply the vendor-released patch per the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-18209; the exact fix version is not independently confirmed from available CPE or reference data, so administrators should consult the advisory directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today