Keycloak Services: Nine Auth and Policy Bypass Vulnerabilities Disclosed Together
Nine vulnerabilities affecting Keycloak Services were disclosed on July 28, 2026, targeting identity provider, client policy, and token handling mechanisms.
Key findings
- Nine vulnerabilities in Keycloak Services disclosed on July 28, 2026, impacting authentication and authorization.
- Multiple CVEs involve bypasses in identity provider and client policy configurations.
- Token introspection and external access-token exchanges are affected by several moderate-severity flaws.
- Issues identified in OIDC and SAML protocols could lead to parameter pollution and open redirects.
- Disclosures span a range of severities from low to moderate, requiring user review and patching.
On July 28, 2026, a batch of nine vulnerabilities was disclosed for Keycloak Services, affecting various authentication and authorization mechanisms. These vulnerabilities, disclosed within a two-hour window, highlight potential weaknesses in how Keycloak handles identity providers, client policies, and token introspection. The disclosures primarily focus on bypasses and misconfigurations that could allow unauthorized access or information leakage.
Several vulnerabilities center on identity provider and client policy configurations. CVE-2026-18201 allows generic identity provider creation to bind brokers to organizations without proper authorization, potentially leading to misconfigurations. Similarly, CVE-2026-18203 describes an issue where group policy's extendChildren function incorrectly matches sibling group path prefixes, which could lead to unintended group memberships or policy applications.
Client policy configurations are further impacted by CVE-2026-18206, which details a bypass in client policy's source-host wildcard domain matching. This could allow clients to connect from unexpected hosts. Another policy-related vulnerability, CVE-2026-18211, involves a bypass of the secure-client-uris policy via localhost-prefixed domains, potentially enabling malicious redirection.
Token handling and introspection are also areas of concern. CVE-2026-18208 points to an issue where inactive out-of-audience token introspection can leak signed JWT claims, potentially exposing sensitive information.
External identity provider integrations present further risks. CVE-2026-18207 and CVE-2026-18215 specifically address bypasses in external access-token exchanges. CVE-2026-18207, related to Google integration, bypasses the hosted-domain restriction, while CVE-2026-18215, concerning Microsoft integration, bypasses the configured tenant. These could allow unauthorized access through misconfigured external IdPs.
Additionally, two vulnerabilities relate to OpenID Connect (OIDC) and SAML protocols. CVE-2026-18209 describes an OIDC redirect_uri fragment bypass in the HTTP parameter pollution check, which could lead to open redirect vulnerabilities. CVE-2026-18217 highlights a SAML HTTP-Redirect binding response that preserves the query string, leading to parameter pollution and potential security risks.
The impact of these vulnerabilities varies, with severities ranging from low to moderate. Users of Keycloak Services are advised to review these disclosures and apply any available patches or mitigations to secure their deployments against potential misconfigurations and unauthorized access vectors. The clustered nature of these disclosures suggests a focused review of Keycloak's security posture regarding authentication and authorization flows.