CVE-2026-18214: Keycloak Auth Bypass Vulnerability

CVE-2026-18214 Overview

CVE-2026-18214 is an authorization flaw in Keycloak affecting the Google identity provider integration. Keycloak supports Google login and can restrict access to specific Google Workspace domains. The token exchange feature, which swaps a Google token for a Keycloak token, does not enforce these domain restrictions. An attacker with a valid Google account from any domain can bypass the intended access control and obtain tokens for the target Keycloak realm. The issue is tracked as a Missing Authorization weakness [CWE-862].

Critical Impact
Attackers holding any valid Google account can bypass Google Workspace domain restrictions and gain access to Keycloak realms configured to trust a specific corporate domain.

Affected Products

Keycloak identity and access management server
Red Hat build of Keycloak
Red Hat Single Sign-On deployments using the Google identity provider with domain restrictions

Discovery Timeline

2026-07-31 - CVE-2026-18214 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18214

Vulnerability Analysis

Keycloak's Google identity provider exposes a hostedDomain configuration option. Administrators use this option to restrict authentication to accounts belonging to one or more Google Workspace domains. During a standard OpenID Connect login, Keycloak validates the hd claim in the Google ID token against the configured domain list before issuing session tokens.

The token exchange endpoint provides a separate code path. It accepts an external Google access token or ID token and returns a Keycloak-issued token for the same user. This path performs identity brokering but omits the Google Workspace domain check enforced during interactive login. An external subject from an unrelated Google domain therefore receives a valid Keycloak token for the realm.

The flaw is an authorization gap rather than a cryptographic or memory safety issue. Successful abuse requires the attacker to already hold a valid Google account and to reach an endpoint that permits token exchange, which limits the population of viable attackers but does not require privileged access to the target Keycloak instance.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in the token exchange handler for the Google identity provider. The handler validates the external Google token signature and subject but does not re-apply the hostedDomain policy that the standard login flow enforces. Domain restriction is treated as a login-time control rather than an identity-level invariant.

Attack Vector

An attacker with any valid Google account obtains a Google access token or ID token through normal Google OAuth flows. The attacker then calls the Keycloak token exchange endpoint at /realms/{realm}/protocol/openid-connect/token with grant_type=urn:ietf:params:oauth:grant-type:token-exchange and supplies the Google token as subject_token. Keycloak brokers the identity and returns a realm token even though the account belongs to a Google Workspace domain outside the configured allowlist. Refer to the Red Hat CVE-2026-18214 Advisory and Red Hat Bug Report #2508308 for vendor technical details.

Detection Methods for CVE-2026-18214

Indicators of Compromise

Token exchange requests to Keycloak where the subject_token originates from a Google iss claim outside the configured hostedDomain allowlist.
New Keycloak user federation entries linked to Google identities with hd values that do not match the organization's Workspace domain.
Successful authentications in Keycloak audit logs where the identity provider is Google but no corresponding interactive browser login is recorded.

Detection Strategies

Enable Keycloak event logging for TOKEN_EXCHANGE and IDENTITY_PROVIDER_LOGIN events and forward them to a central log platform.
Correlate Keycloak brokered login events with the hd claim from Google to identify accounts outside the sanctioned Workspace domain.
Compare user email domains created through the Google identity provider against an approved domain allowlist and alert on deviations.

Monitoring Recommendations

Monitor the Keycloak /protocol/openid-connect/token endpoint for spikes in token exchange grant types.
Track newly linked federated identities and flag any Google subject with a hd claim that does not match policy.
Review Keycloak admin console changes to Google identity provider configuration, including hostedDomain modifications.

How to Mitigate CVE-2026-18214

Immediate Actions Required

Disable the token exchange feature for the affected realm until a patched Keycloak build is deployed.
Restrict which clients hold the token-exchange permission on the Google identity provider to a minimal, trusted set.
Audit existing federated users originating from Google and remove accounts whose hd claim falls outside the approved Workspace domain.

Patch Information

Apply the fixed Keycloak version as tracked in the Red Hat CVE-2026-18214 Advisory. Red Hat customers should follow guidance in Red Hat Bug Report #2508308 for the specific errata that address the token exchange domain check.

Workarounds

Turn off the token exchange feature by removing the token_exchange preview or v2 feature flag from the Keycloak startup configuration.
Remove or scope down the Exchange To permission on the Google identity provider inside the Keycloak admin console.
Enforce Google Workspace domain restrictions at the Google OAuth client configuration level so that tokens for other domains are not issued in the first place.

bash

# Configuration example: disable token exchange feature in Keycloak
# Remove or invert the feature flag when starting the server
kc.sh start --features-disabled=token-exchange,admin-fine-grained-authz

# Alternatively, in keycloak.conf
# features-disabled=token-exchange