CVE-2026-18215: Keycloak Authentication Bypass Vulnerability

CVE-2026-18215 Overview

CVE-2026-18215 is an authentication flaw in Keycloak's Microsoft identity provider integration. Keycloak supports restricting logins to a specific Microsoft organization (tenant) when brokering authentication through Microsoft accounts. The token exchange feature ignores this tenant restriction. An attacker holding a valid Microsoft token issued by any tenant can exchange it for a session in the target Keycloak realm. This grants access to protected resources and identities within the realm. The weakness is classified as [CWE-287] Improper Authentication.

Critical Impact
Attackers with a Microsoft token from any tenant can bypass tenant restrictions and gain access to Keycloak realms configured to trust a single Microsoft organization.

Affected Products

Keycloak (Microsoft identity provider with token exchange enabled)
Red Hat Build of Keycloak (see vendor advisory for affected versions)
Red Hat Single Sign-On distributions integrating the affected identity broker code

Discovery Timeline

2026-07-31 - CVE-2026-18215 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18215

Vulnerability Analysis

Keycloak brokers authentication to Microsoft Entra ID through its Microsoft identity provider. Administrators can restrict logins to a single tenant by configuring the tenant identifier on the provider. During interactive login, Keycloak enforces this restriction by validating the token issuer against the configured tenant.

The token exchange endpoint does not apply the same check. When a subject token issued by Microsoft is submitted to the exchange endpoint, Keycloak accepts the token without verifying that it originated from the permitted tenant. Any Microsoft tenant that Entra ID trusts as an issuer is treated as valid.

Exploitation requires an authenticated client with permission to invoke token exchange, which is reflected in the attack complexity and privileges-required components of the score. Successful exchange yields a Keycloak-issued token bound to the attacker's federated identity, enabling access to realm resources.

Root Cause

The token exchange code path skips the tenant validation logic that the interactive broker flow performs. The subject token's iss and tid claims are not compared against the identity provider's configured tenant restriction before the federated identity is provisioned.

Attack Vector

The attack is remote and network-based. An attacker registers or controls an account in an unrelated Microsoft tenant, obtains a valid access token for that account, and calls the Keycloak /token endpoint with grant_type=urn:ietf:params:oauth:grant-type:token-exchange. The exchanged token grants access to the target realm despite the tenant restriction.

See the Red Hat CVE-2026-18215 Advisory and Red Hat Bug Report #2508309 for technical details.

Detection Methods for CVE-2026-18215

Indicators of Compromise

Successful token-exchange grant requests where the subject token's tid claim does not match the identity provider's configured Microsoft tenant.
New federated identity links in Keycloak that reference Microsoft accounts outside the expected organization.
Session establishment for users whose iss claim points to a Microsoft login endpoint for an unrelated tenant.

Detection Strategies

Parse Keycloak event logs (EVENT and ADMIN_EVENT tables or JSON audit stream) for TOKEN_EXCHANGE events tied to the Microsoft identity provider and cross-check the tid claim.
Alert on first-seen Microsoft tenant identifiers appearing in broker events for realms that enforce a single-tenant policy.
Correlate token exchange activity with client IDs that should not normally initiate exchanges against the Microsoft broker.

Monitoring Recommendations

Forward Keycloak audit events to a centralized log platform and retain subject token claims for post-incident analysis.
Baseline the set of Microsoft tenant IDs observed in the realm and flag deviations.
Track token exchange rates per client and per identity provider to surface anomalous spikes.

How to Mitigate CVE-2026-18215

Immediate Actions Required

Apply the Keycloak update referenced in the Red Hat CVE-2026-18215 Advisory as soon as it is available for your distribution.
Disable token exchange on the Microsoft identity provider until the patch is applied if tenant restriction is a security requirement.
Audit federated identity links created since token exchange was enabled and remove entries tied to unauthorized tenants.

Patch Information

Refer to the Red Hat CVE-2026-18215 Advisory for the fixed Keycloak and Red Hat Build of Keycloak versions. The vendor tracking issue is Red Hat Bug Report #2508309.

Workarounds

Revoke the token-exchange scope from clients that do not require it, using the Keycloak admin console under the client's permissions.
Restrict which clients can call the token exchange endpoint through fine-grained authorization on the Microsoft identity provider.
Enforce a stricter mapper on the Microsoft broker that rejects sessions whose tid claim does not match the allowed tenant.

bash

# Disable token exchange permission on the Microsoft identity provider
kcadm.sh update identity-provider/instances/microsoft/management/permissions \
  -r <realm> \
  -s enabled=false