CVE-2026-18569

Katalog CVE

CVSS 3.7 · Low EPSS 0,25%

Kerentanan Improper Verification of Cryptographic Signature pada redhat build of keycloak. Skor CVSS 3.1 3.7 (Low) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.

Rincian

Terbit di NVD

4 Agustus 2026

Terakhir diubah

10 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber redhat.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-18569 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2509755 issue tracking · advisory vendor