CVE-2026-18201: Keycloak Auth Bypass Vulnerability

CVE-2026-18201 Overview

CVE-2026-18201 is a missing authorization vulnerability [CWE-862] in Keycloak's administrative API for managing identity providers and organizations. An administrator with permission to manage identity providers can link a new provider to an organization without holding the required permission to manage that organization. The flaw allows a lower-privileged administrator to influence how users authenticate into specific organizations. The issue affects identity federation flows and organization scoping within Keycloak deployments.

Critical Impact
An authenticated administrator can bind identity providers to organizations they do not manage, enabling unauthorized changes to login flows and potential redirection of user authentication.

Affected Products

Keycloak identity and access management server
Red Hat build of Keycloak
Deployments using organizations with delegated identity provider administration

Discovery Timeline

2026-07-29 - CVE-2026-18201 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18201

Vulnerability Analysis

Keycloak exposes administrative APIs that separate the management of identity providers from the management of organizations. Each concern is intended to be gated by distinct role-based permissions. The vulnerability breaks this separation. An administrator granted only the identity-provider management role can associate a new identity provider with an organization scope, bypassing the organization management check.

The consequence is unauthorized influence over authentication flows. By linking a controlled or misconfigured identity provider to a target organization, the attacker changes how users of that organization log in. This creates a path to integrity compromise of authentication decisions without requiring full organization administrator rights.

Exploitation requires an authenticated actor with elevated but constrained privileges. No user interaction is needed, and the attack proceeds over the network against the admin API.

Root Cause

The root cause is a missing authorization check [CWE-862] on the code path that links an identity provider to an organization. The handler validates the caller's permission over the identity provider resource but does not verify the caller's permission over the target organization resource. The two permission domains must both be enforced when a link operation crosses them.

Attack Vector

The attacker authenticates to the Keycloak admin API with an account that holds identity provider management rights. The attacker then issues a request that associates a newly created or existing identity provider with an organization the attacker does not manage. The server accepts the link operation. Subsequent logins scoped to that organization can be steered through the attacker-influenced identity provider.

See the Red Hat CVE-2026-18201 Advisory and the Red Hat Bug #2508290 Report for vendor technical details.

Detection Methods for CVE-2026-18201

Indicators of Compromise

Admin API calls that link identity providers to organizations where the caller lacks organization management roles.
New or modified identity provider bindings on organizations not previously associated with the calling admin account.
Unexpected changes to organization login flows shortly after identity provider creation events.

Detection Strategies

Audit Keycloak admin event logs for IDENTITY_PROVIDER_CREATE, IDENTITY_PROVIDER_UPDATE, and organization link events, correlated to the actor's role assignments.
Compare the acting administrator's role set against the target organization's management roles at the time of each identity provider link operation.
Alert when an identity provider is bound to an organization by an actor whose role does not include organization management for that organization.

Monitoring Recommendations

Forward Keycloak admin events and JSON-formatted server logs to a centralized SIEM for retention and correlation.
Baseline expected identity provider changes per organization and flag deviations for review.
Review privileged role assignments across the Keycloak realm to reduce the number of administrators holding only partial rights that can trigger this flaw.

How to Mitigate CVE-2026-18201

Immediate Actions Required

Apply the Keycloak update referenced in the Red Hat CVE-2026-18201 Advisory once available for your distribution.
Inventory administrators holding identity provider management roles and validate they should retain that capability.
Review existing identity provider bindings on each organization and remove any that cannot be justified.

Patch Information

Refer to the Red Hat CVE-2026-18201 Advisory and Red Hat Bug #2508290 Report for fixed versions and errata specific to Red Hat build of Keycloak. Upstream Keycloak users should track the corresponding project release notes and upgrade to the patched release.

Workarounds

Restrict the identity provider management role to a small set of trusted administrators until the patch is applied.
Enforce separation of duties by ensuring identity provider administrators do not act on organizations they cannot legitimately manage.
Enable and monitor Keycloak admin event logging to detect unauthorized identity provider link operations.

bash

# Configuration example: enable admin events with representation for auditing
kcadm.sh update events/config -r <realm> \
  -s 'adminEventsEnabled=true' \
  -s 'adminEventsDetailsEnabled=true'