CVE-2026-18209: Keycloak Auth Bypass Vulnerability

CVE-2026-18209 Overview

CVE-2026-18209 is a flaw in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The HTTP parameter pollution check inspects only the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can inject duplicate security parameters into the login response. A misconfigured client application may then trust the attacker's injected data instead of legitimate values returned by Keycloak. This can result in session fixation or account confusion. The vulnerability is tracked under CWE-1288: Improper Validation of Consistency within Input.

Critical Impact
Attackers can exploit fragment-based parameter injection against wildcard redirect URIs to trigger session fixation or account confusion in downstream OIDC clients.

Affected Products

Keycloak (keycloak-services component handling OIDC flows)
Red Hat build of Keycloak (see Red Hat CVE-2026-18209)
OIDC client applications configured with wildcard redirect URIs

Discovery Timeline

2026-07-31 - CVE-2026-18209 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18209

Vulnerability Analysis

Keycloak validates redirect URIs during OIDC authentication to prevent HTTP parameter pollution. The validation logic inspects only the query string of the URL. The URL fragment, delimited by #, is excluded from the parameter pollution check. This gap allows an attacker to smuggle duplicate OIDC response parameters through the fragment portion of a redirect URL.

The issue becomes exploitable when a client registration uses a wildcard in its allowed redirect URI. The wildcard broadens the set of acceptable target URLs, permitting attacker-controlled fragment content to pass validation. The client application receiving the redirect may then read the injected values instead of the authentic authorization response.

Successful exploitation requires user interaction and specific client misconfiguration, which raises attack complexity. The impact is limited to integrity, with no direct confidentiality or availability loss.

Root Cause

The root cause is inconsistent input validation within keycloak-services. The parameter pollution guard parses only the query component of the redirect URL and does not normalize or inspect fragment-encoded parameters. Because OIDC implicit and hybrid flows deliver tokens and state values through the fragment, injected duplicates in that region can override or shadow legitimate parameters at the client.

Attack Vector

An attacker crafts an authorization request that targets a Keycloak client registered with a wildcard redirect URI. The malicious URL appends duplicate parameters such as state, code, or id_token inside the fragment. The victim authenticates to Keycloak, and Keycloak issues a redirect back to the client. If the client parses fragment parameters without deduplication, it accepts the attacker's values. This can bind the victim's session to an attacker-controlled state or authorization context, enabling session fixation or account confusion. No verified public exploit code is available for this issue.

Detection Methods for CVE-2026-18209

Indicators of Compromise

Authorization requests containing duplicate OIDC parameters such as state, code, nonce, or id_token in the URL fragment.
Keycloak client registrations using wildcard characters in redirectUris.
Unexpected state mismatches or repeated authentication attempts from the same session.

Detection Strategies

Inspect Keycloak access and event logs for redirect URIs containing # followed by OIDC response parameter names.
Audit client configurations for wildcard entries in Valid Redirect URIs and flag them for review.
Correlate authentication events with downstream client session anomalies such as state verification failures.

Monitoring Recommendations

Enable Keycloak event logging for LOGIN, CODE_TO_TOKEN, and CLIENT_LOGIN events and forward them to a central SIEM.
Alert on OIDC callbacks where fragment-encoded parameters duplicate query-string parameters.
Track changes to client redirect URI settings through configuration management and admin event logs.

How to Mitigate CVE-2026-18209

Immediate Actions Required

Remove wildcard entries from Keycloak client Valid Redirect URIs and replace them with exact URLs.
Update client applications to reject OIDC responses containing duplicate parameters across query and fragment.
Apply vendor patches referenced in Red Hat CVE-2026-18209 once available for your distribution.

Patch Information

Red Hat tracks remediation for this issue under Red Hat Bug #2508305 and the Red Hat CVE-2026-18209 advisory. Administrators should upgrade Keycloak to the fixed release identified in the vendor advisory and verify that the parameter pollution check inspects both query and fragment portions of redirect URLs.

Workarounds

Restrict redirectUris to fully qualified, exact URLs and avoid wildcard patterns.
Enforce strict state and nonce validation on the client side, rejecting responses with duplicate values.
Require the OIDC authorization code flow with PKCE instead of implicit or hybrid flows that rely on fragment-delivered tokens.

bash

# Example: audit Keycloak clients for wildcard redirect URIs using kcadm.sh
/opt/keycloak/bin/kcadm.sh get clients \
  -r <realm> \
  --fields 'clientId,redirectUris' \
  | grep -E '"\*"|\*"'