CVE-2026-18215 PUBLISHED

Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

Assigner: redhat
Reserved: 29.07.2026 Published: 31.07.2026 Updated: 31.07.2026

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 6.8

Product Status

Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected
Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected
Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected
Vendor Red Hat
Product Red Hat Data Grid 8
Versions Default: unaffected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform Expansion Pack
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Single Sign-On 7
Versions Default: unaffected

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Credits

  • Red Hat would like to thank Paul Bottinelli (Trail of Bits) for reporting this issue.

References

Problem Types

  • Improper Authentication CWE