CVE-2026-18217 Auth bypass in Red Hat Build of Keycloak

Low 3.4 Published 31 Jul 2026 Updated 31 Jul 2026

Attackers can hijack user sessions by exploiting parameter pollution in SAML HTTP-Redirect responses when wildcard redirect URLs are configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-18217?

CVE-2026-18217 is a low-severity authentication bypass vulnerability in Redhat Build of Keycloak, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account.

Weakness: CWE-20

Which versions are affected by CVE-2026-18217?

It affects 1 product.

Products include Redhat Build of Keycloak.

How do I fix CVE-2026-18217?

No fix has been published for CVE-2026-18217 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-18217 being exploited?

There is no known exploitation of CVE-2026-18217 in the wild and no public exploit code.

All Redhat Build of Keycloak vulnerabilities

Sources

Also known as GHSA-82v3-6227-jc8x.