CVE-2026-18207: Keycloak Auth Bypass Vulnerability

CVE-2026-18207 Overview

CVE-2026-18207 affects the client policy enforcement mechanism of Keycloak, an open source identity and access management solution. The flaw stems from the system evaluating group membership by name rather than by a unique identifier. An attacker holding client management privileges can join a group that shares the same name but sits in a different branch of the group hierarchy. This allows the attacker to bypass client policy checks and register or update clients without applying the required security hardening profiles. The issue is classified under CWE-285: Improper Authorization.

Critical Impact
An authenticated user with client management privileges can bypass client policy enforcement, register unhardened clients, and undermine organization-wide security profiles.

Affected Products

Keycloak (client policy enforcement component)
Red Hat build of Keycloak
Red Hat Single Sign-On distributions incorporating the affected component

Discovery Timeline

2026-07-29 - CVE-2026-18207 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-18207

Vulnerability Analysis

Keycloak enforces client policies to guarantee that clients registered or modified through the dynamic client registration or admin APIs follow required security profiles. These profiles can mandate settings such as PKCE, secure redirect URIs, signed authentication requests, and hardened token endpoints.

The policy engine can restrict which administrators may bypass or apply specific profiles based on group membership. In the vulnerable code path, the membership check compares group names as strings rather than resolving them to the group's unique identifier. Keycloak allows multiple groups with identical names to exist in different locations within the group tree, which makes the name-based comparison ambiguous.

An attacker with client management privileges can create or join a group whose name matches a privileged group elsewhere in the hierarchy. The engine then treats the attacker as a member of the intended privileged group and skips the enforcement step. The result is an authorization bypass affecting the integrity of client configurations, without breaking confidentiality or availability.

Root Cause

The root cause is an insecure identifier choice in the authorization check. Group equality is decided by the name attribute instead of the immutable group id or full hierarchical path. This design assumption fails once the realm contains multiple groups sharing the same name in different subtrees.

Attack Vector

Exploitation is network-based and requires an authenticated account with client management privileges in the target realm. The attacker performs the following logical steps:

Identify a group name referenced by a Keycloak client policy condition.
Create or join a group with the same name in an unrelated branch of the group tree.
Invoke client registration or update operations that would otherwise be rejected by the policy.

Because the policy engine matches on group name, the attacker's membership satisfies the condition and the client is registered or updated without required hardening. No user interaction is required. Technical details are described in the Red Hat CVE-2026-18207 Advisory.

Detection Methods for CVE-2026-18207

Indicators of Compromise

Creation of new groups whose names duplicate existing groups referenced by client policy conditions.
Client registrations or updates that succeed despite missing required policy attributes such as PKCE or signed request objects.
Admin audit events showing group membership changes shortly before client configuration changes by the same principal.

Detection Strategies

Enable Keycloak admin events and review CREATE_GROUP, GROUP_MEMBERSHIP, CLIENT_REGISTER, and CLIENT_UPDATE operations for correlated sequences.
Compare registered client configurations against expected client policy profiles and alert on drift.
Inventory all groups in each realm and flag duplicate names across different parent paths.

Monitoring Recommendations

Forward Keycloak admin and event logs into a centralized analytics platform for correlation across identity and application layers.
Alert on any privilege-holding account that creates a group and then modifies a client within a short time window.
Baseline client policy evaluation outcomes and investigate unexpected policy skip decisions.

How to Mitigate CVE-2026-18207

Immediate Actions Required

Audit all realms for groups sharing the same name across different hierarchy branches and reconcile duplicates.
Review recently registered or updated clients for compliance with required security profiles and remediate any that bypass hardening.
Restrict the manage-clients and create-client roles to a minimal set of trusted administrators until the fix is applied.

Patch Information

Refer to the Red Hat CVE-2026-18207 Advisory for updated Keycloak and Red Hat build of Keycloak packages. Apply the vendor-provided patch that changes the group evaluation logic to use unique group identifiers or full hierarchical paths.

Workarounds

Rename duplicate groups so that names referenced by client policies are unique within the realm.
Replace group-based policy conditions with role-based conditions, which are evaluated by identifier.
Temporarily disable dynamic client registration and require administrator review for all client configuration changes.

bash

# Example: list groups in a realm and identify duplicate names using kcadm.sh
kcadm.sh config credentials --server https://keycloak.example.com \
    --realm master --user admin

kcadm.sh get groups -r myrealm --format csv --fields id,name,path \
    | sort -t, -k2 \
    | awk -F, 'NR>1 {print $2}' | sort | uniq -d