CVE-2026-18215 Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant
Attackers can bypass tenant restrictions in Microsoft token exchange to access unauthorized Keycloak realms and sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-18215?
CVE-2026-18215 is a medium-severity authentication bypass vulnerability in Redhat Build of Keycloak, published on 31 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.
Weakness: CWE-287
Which versions are affected by CVE-2026-18215?
1 open source package ship an affected version, including keycloak. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
keycloak Bitnami | All versions | 26.7.3 |
Products include Redhat Build of Keycloak.
How do I fix CVE-2026-18215?
Upgrade keycloak to 26.7.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18215 being exploited?
There is no known exploitation of CVE-2026-18215 in the wild and no public exploit code.
Other vulnerabilities in Redhat Build of Keycloak
- CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
- CVE-2026-3047 Keycloak SAML Broken has Authentication Bypass by Primary Weakness
- CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
- CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
- CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
Sources
Also known as BIT-keycloak-2026-18215, CLEANSTART-2026-HB26759, GHSA-v8h5-7wp9-qxxv.