CVE-2026-18211: Keycloak Auth Bypass Vulnerability

CVE-2026-18211 Overview

CVE-2026-18211 is an input validation flaw in the secure-client-uris client policy executor within Keycloak core services. The component enforces security requirements on client configurations, including requiring encrypted connections for redirect URIs. The executor performs a prefix-based check against the URI string rather than parsing and validating the host component. An attacker who registers or influences a specially crafted domain name can bypass the transport security requirement. Successful exploitation permits interception of authentication codes over unencrypted connections. The vulnerability is tracked under CWE-20: Improper Input Validation.

Critical Impact
An attacker can bypass Keycloak's redirect URI transport security policy and intercept OAuth/OIDC authentication codes over cleartext HTTP.

Affected Products

Red Hat build of Keycloak (see Red Hat CVE-2026-18211 Advisory)
Keycloak core services running the secure-client-uris client policy executor
Downstream identity products embedding vulnerable Keycloak versions

Discovery Timeline

2026-07-31 - CVE-2026-18211 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18211

Vulnerability Analysis

Keycloak's secure-client-uris client policy executor validates redirect URIs and other client-registered URIs to enforce that only encrypted schemes are permitted. The executor implements this check by inspecting the leading characters of the URI string. This shortcut fails to decompose the URI into scheme, authority, host, and path components before evaluation.

An attacker who controls a hostname or registers a client with a URI whose serialized form begins with an approved prefix can defeat the check. The URI ultimately resolves to an attacker-controlled endpoint reachable over unencrypted transport. When Keycloak issues an authorization code redirect to that endpoint, the code traverses the network in cleartext.

Exploitation requires user interaction and a successful redirect flow, which raises attack complexity. The impact scope covers confidentiality and integrity of the authentication exchange for affected clients.

Root Cause

The root cause is improper input validation ([CWE-20]). The policy executor treats a URI as an opaque string and applies a startsWith-style comparison instead of parsing the URI and validating the host and scheme separately. RFC 3986 URI syntax permits userinfo, ambiguous authority segments, and other constructs that make prefix matching unsafe.

Attack Vector

The attack originates over the network and targets clients registered in a Keycloak realm that relies on the secure-client-uris policy for transport security. An attacker crafts a redirect URI whose textual prefix satisfies the check but whose effective host is attacker-controlled and served over HTTP. During a standard OAuth 2.0 or OpenID Connect authorization code flow, the victim's browser is redirected to the malicious endpoint, and the authorization code is transmitted without encryption. The attacker captures the code from the cleartext channel and exchanges it for tokens.

No verified public exploit code is available. Refer to the Red Hat Bug Report #2508306 for vendor technical details.

Detection Methods for CVE-2026-18211

Indicators of Compromise

Client registrations or updates containing redirect URIs with unusual host constructs, encoded characters, or http:// schemes that were accepted despite policy enforcement.
Authorization code redirects in Keycloak event logs targeting hosts on non-TLS ports (80, 8080) shortly after a client configuration change.
Repeated failed token exchanges from client IPs that differ from the browser IP that received the redirect.

Detection Strategies

Audit the Keycloak admin events stream for CLIENT-CREATE and CLIENT-UPDATE operations and flag any redirect URI that resolves to an HTTP endpoint.
Parse stored client redirect URIs with a strict URI parser and re-validate scheme and host against the intended policy, independent of the built-in executor.
Correlate authorization code issuance events with downstream token requests to identify codes redeemed from unexpected network origins.

Monitoring Recommendations

Forward Keycloak admin and login event logs to a centralized analytics platform and alert on redirect URIs that fail out-of-band scheme validation.
Monitor egress traffic from user browsers for OAuth code= parameters carried over unencrypted HTTP to unapproved domains.
Track the rate of new client registrations per realm and alert on anomalous spikes tied to a single administrator or service account.

How to Mitigate CVE-2026-18211

Immediate Actions Required

Apply the fixed Keycloak release referenced in the Red Hat CVE-2026-18211 Advisory once available for your distribution.
Enumerate all clients in every realm and remove or correct redirect URIs whose effective host is served over HTTP.
Rotate client secrets and revoke active sessions for any client whose redirect URI configuration cannot be verified as safe.

Patch Information

Red Hat has published tracking for this issue under the Red Hat CVE-2026-18211 Advisory and Red Hat Bug Report #2508306. Consult these references for fixed package versions and errata specific to your Keycloak or Red Hat build of Keycloak deployment.

Workarounds

Enforce redirect URI validation at a reverse proxy or Web Application Firewall by rejecting responses whose Location header contains http:// for federated authentication flows.
Restrict client registration to a small set of trusted administrators and require code review of every redirect URI change until the patch is deployed.
Configure realm-level policies to require exact-match redirect URIs and disallow wildcard patterns that increase the attack surface of the prefix check.

bash

# Configuration example: audit Keycloak clients for non-HTTPS redirect URIs
# Requires kcadm.sh from the Keycloak distribution and an authenticated session
kcadm.sh get clients -r <realm> \
  --fields 'clientId,redirectUris,rootUrl' \
  --format csv | grep -Ei 'http://|ftp://'