VULNERABILITY INTELLIGENCE

CVE-2026-18214

CVSS score6.8 MEDIUM
EPSS probability0.40%
CISA KEVNot currently listed
Published2026-07-31
Last modified2026-09-16
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.

Weakness classification

  • secalert@redhat.com: CWE-862

Primary references