6.8
Medium
CVE-2026-18214 Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google…
Description
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat build of Keycloak 26.6 26.6 | earliest → < 26.6-20 | 26.6-20 |
| Red Hat build of Keycloak 26.6.7 | Versions not published |
References
- RHSA-2026:68277 access.redhat.com
- RHSA-2026:68278 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2508308 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Build of Keycloak
The 266 CVEs of Red Hat Build of Keycloak →
CVE-2026-97847
Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
7.1
High
CVE-2026-97175
Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
8.8
High
CVE-2026-97174
Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
6.8
Medium
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
High