CVE-2026-18209
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
Scoring
- Severity
- LOW
- CVSS base score
- 3.4
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
- EPSS probability
- 0.19%
- CWE
- CWE-1288
- Published
- 2026-07-31
- Last modified
- 2026-07-31
Weakness type
Related vulnerabilities
- CVE-2026-69793 — Windows TCP/IP Security Feature Bypass Vulnerability
- CVE-2026-18238 — OOBR in rpcap client in libpcap before 1.10.7
- CVE-2026-18794 — OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
- CVE-2026-73219 — CVAT: Denial of service with regards to automatic annotation
- CVE-2026-15943 — Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change
- CVE-2026-42982 — Windows Secure Kernel Mode Elevation of Privilege Vulnerability
- CVE-2026-14781 — Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email
- CVE-2026-9689 — Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604