Skip to content
Sign in
3.7 Low

CVE-2026-18206 Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass

Description

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitable remotely over the network, without an account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
High
Privileges required
None
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Affected products and versions

Product Affected versions Fixed in
Red Hat Build of Keycloak Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat build of Keycloak 26.6 26.6 earliest → < 26.6-24 26.6-24
Red Hat build of Keycloak 26.6.8 Versions not published

Other CVEs of Red Hat Build of Keycloak

The 277 CVEs of Red Hat Build of Keycloak →
CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 9.1 Critical CVE-2026-9797 Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator 6.5 Medium CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Medium CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Medium
Track this CVE