Keycloak keycloak-services OIDC Param Poll. Reroute Enables Session Fix
CVE-2026-18209 Published on July 31, 2026
Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
Vulnerability Analysis
CVE-2026-18209 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
Improper Validation of Consistency within Input
The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Products Associated with CVE-2026-18209
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
