What’s Vulnerable › Vulnerabilities

CVE-2026-18211: Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-31 · updated 2026-08-07
• Weakness: CWE-20

Description

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.

Affected products

• Red Hat build of Keycloak 26.4: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-18211
• https://bugzilla.redhat.com/show_bug.cgi?id=2508306

Get alerted when CVE-2026-18211 or the next vulnerability affects your stack