CVE-2026-18207

Description

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles.

Traduire en français

Produits concernés

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• Red Hat JBoss Enterprise Application Platform Expansion Pack
• Red Hat Single Sign-On 7
• Redhat build of keycloak

Scores CVSS

Faiblesses (CWE)

• CWE-285

Références

• https://access.redhat.com/security/cve/CVE-2026-18207 Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories