CVE-2026-18215

Katalog CVE

CVSS 8.1 · High EPSS 0,40%

Kerentanan Improper Authentication pada redhat build of keycloak. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.

Rincian

Terbit di NVD

31 Juli 2026

Terakhir diubah

16 September 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-18215 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2508309 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:68277
• https://access.redhat.com/errata/RHSA-2026:68278