CVE-2026-18209 Red Hat CVE debrief

Who should care

Administrators of Keycloak instances and developers of client applications using Keycloak for OIDC authentication should review their configurations and implementations to prevent session fixation or account confusion attacks. They should also verify Keycloak configurations for wildcard redirect URIs and ensure client applications handle security parameters correctly.

Technical summary

A flaw in the keycloak-services component of Keycloak allows attackers to inject duplicate security parameters into the login response by exploiting the security check's limitation to only inspect the query portion of a redirect URL and ignore the fragment portion. This issue can lead to session fixation or account confusion if a client application is not configured correctly. The vulnerability affects Keycloak instances with wildcard redirect URIs and client applications that do not handle security parameters correctly. Reviewing Keycloak configurations and client applications for proper setup can help prevent session fixation or account confusion attacks.

Defensive priority

Review Keycloak configurations and client applications for proper setup to prevent session fixation or account confusion attacks.

Recommended defensive actions

• Review Keycloak configurations for wildcard redirect URIs
• Verify client applications for correct security parameter handling
• Monitor for suspicious login responses
• Confirm whether affected Keycloak instances exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence is limited; verify Keycloak configurations and client applications for proper setup. The CVE record was published on 2026-07-31T08:16:27.467Z and has not been modified since then. However, defenders should review Keycloak configurations for wildcard redirect URIs, verify client applications for correct security parameter handling, and monitor for suspicious login responses.

Official resources