EUVD-2026-51487
GHSA-c8xx-fr3x-6m5w
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
AC:H reflects dual prerequisite of wildcard redirect URI plus non-compliant client; S:C captures integrity impact landing on the relying party, not Keycloak itself.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
AnalysisAI
Incomplete HTTP parameter pollution validation in Keycloak's keycloak-services component exposes OIDC authentication flows to session fixation and account confusion attacks. The security check inspects only the query string of redirect URLs while ignoring the URL fragment, enabling an attacker to inject duplicate security parameters when a client is configured with a wildcard redirect URI. No public exploit has been identified at time of analysis; the CVSS score of 3.4 (AC:H, UI:R) correctly reflects that exploitation requires both a permissive wildcard redirect URI configuration and a non-spec-compliant client application that trusts attacker-injected parameters over Keycloak-issued values.
Technical ContextAI
Keycloak is Red Hat's enterprise identity and access management (IAM) platform implementing OpenID Connect (OIDC) and OAuth 2.0. During authentication flows, keycloak-services validates redirect URIs to prevent open-redirect and parameter injection attacks. The flaw, classified as CWE-1288 (Improper Validation of Consistency within Input), manifests because the HTTP parameter pollution check applies only to the query component of a redirect URL (e.g., the portion after '?') while completely disregarding the fragment component (the '#...' portion). In OIDC flows, security parameters such as state, nonce, and code are critical to binding the session; if these can be injected or duplicated via the fragment into the response URL against a wildcard-registered redirect URI (e.g., 'https://app.example.com/*'), a misconfigured relying party may process the attacker-controlled values rather than the legitimate ones. Affected CPE identifiers cover Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat JBoss EAP Expansion Pack, and Red Hat Single Sign-On 7.
RemediationAI
Apply the vendor-released patch per the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-18209; the exact fix version is not independently confirmed from available CPE or reference data, so administrators should consult the advisory directly. As an immediate compensating control with the highest impact, replace all wildcard redirect URI registrations on OIDC clients with explicit, exact-match allowlists - this eliminates the prerequisite condition entirely and is a security best practice regardless of this CVE. Client applications should additionally enforce strict OIDC parameter validation (state binding, nonce verification) as required by the OIDC Core specification and RFC 6749; doing so ensures that even if fragment injection succeeds, the client rejects the attacker-supplied values. The trade-off of exact redirect URI enforcement is a minor operational overhead requiring URI updates when application endpoints change, but it is the standard-recommended configuration.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same technique Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today