CVEvulnerability

CVE-2026-18214

8.1 HIGH Published 2026-07-31 Modified 2026-09-16 Official page ↗
Status
Modified
Published
2026-07-31
Last modified
2026-09-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-862

Description

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.

Affected configurations

• redhat build of keycloak

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References