CVE-2026-18209: Red Hat Build Of Keycloak

Medium severity, CVSS 4.7. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.

Affected products

• Red Hat Build Of Keycloak: affected versions not specified

Published 2026-07-31. Last modified 2026-09-16.