CVE-2026-18573: Keycloak Auth Bypass Vulnerability

CVE-2026-18573 Overview

CVE-2026-18573 is an authorization flaw in the keycloak-services component of Keycloak, an open source identity and access management platform. The vulnerability enables attackers with client management permissions to bypass realm client policies that enforce authentication requirements on confidential clients. By first creating a public client and then updating it to a confidential client, an attacker sidesteps the policy checks that would normally block weaker authentication configurations. The issue is tracked under CWE-862: Missing Authorization.

Critical Impact
An authenticated attacker with client management permissions can persist confidential clients that violate the realm's intended authentication hardening, undermining client policy enforcement.

Affected Products

Red Hat Keycloak (keycloak-services component)
Red Hat build of Keycloak distributions
Upstream Keycloak deployments using client policies for confidential client hardening

Discovery Timeline

2026-08-02 - CVE-2026-18573 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18573

Vulnerability Analysis

Keycloak realm administrators use client policies to enforce authentication requirements, such as mandating stronger client authenticators on confidential clients. These policies are evaluated when clients are created or modified. The vulnerability stems from improper evaluation of client state during update operations. When a client is created as public, policy checks for confidential client requirements do not apply. When the same client is then updated to confidential, the enforcement logic fails to re-evaluate the client against the full set of policies that should govern its new state.

The result is that a confidential client can persist in the realm with an authentication configuration weaker than the realm's intended baseline. This weakens the identity trust boundary for downstream applications relying on the affected client.

Root Cause

The root cause is a missing authorization check ([CWE-862]) tied to client lifecycle transitions. The update path in keycloak-services does not treat the type change from public to confidential as a trigger for full policy re-evaluation. Instead, the update is validated against the client's prior state rather than its resulting configuration.

Attack Vector

Exploitation requires an authenticated user with client management privileges within a Keycloak realm. The attacker performs a two-step sequence: create a public client, then issue an update to convert it to a confidential client without meeting the policy-mandated authenticator settings. Because the flaw is network-reachable through the Keycloak admin API and requires no user interaction, it is exploitable remotely by any principal holding the required client-management role.

No verified proof-of-concept code has been published. See the Red Hat CVE Advisory and Red Hat Bugzilla Entry #2509764 for authoritative technical details.

Detection Methods for CVE-2026-18573

Indicators of Compromise

Confidential clients whose current authenticator configuration does not satisfy realm client policies
Admin audit events showing a client created as public and subsequently updated to confidential by the same or a related principal
Clients using client-secret or other weaker authenticators in realms that mandate stronger methods such as client-jwt or mTLS

Detection Strategies

Query Keycloak admin events for CLIENT_UPDATE operations that change publicClient from true to false and correlate with the resulting clientAuthenticatorType
Run periodic conformance scans that evaluate every confidential client in each realm against the active client policy set and flag deviations
Alert on client management API calls originating from service accounts or admin users outside expected change windows

Monitoring Recommendations

Forward Keycloak admin and event logs to a centralized SIEM for long-term retention and correlation
Track privileged role assignments granting manage-clients or manage-realm and review changes on a recurring cadence
Baseline the expected distribution of client authenticator types per realm and alert on drift

How to Mitigate CVE-2026-18573

Immediate Actions Required

Review all confidential clients in each realm and verify they comply with the intended client policies; remediate non-compliant clients immediately
Restrict manage-clients and equivalent roles to a minimal set of trusted administrators
Rotate client secrets for any confidential client suspected of having been created through the bypass path

Patch Information

Consult the Red Hat CVE Advisory for CVE-2026-18573 for fixed package versions and the Red Hat Bugzilla Entry #2509764 for tracking status. Apply the fixed Keycloak build for your distribution as soon as it is available and restart the Keycloak server to load the updated keycloak-services component.

Workarounds

Limit client management permissions to a small, audited group of administrators until the patch is applied
Implement out-of-band review of any client whose publicClient attribute transitions from true to false
Use an external policy engine or CI job to validate realm client configurations against declared client policies and reject drift

bash

# Example: enumerate confidential clients and their authenticator type via kcadm
kcadm.sh get clients -r <realm> \
  --fields id,clientId,publicClient,clientAuthenticatorType \
  --format csv --noquotes | \
  awk -F',' '$3=="false" && $4!="client-jwt" {print}'