Identity CVE · OAuth / OIDC / JWT
CVE-2026-18207Keycloak client policy enforcement flaw
high
What broke
Keycloak did not enforce a client policy the way the realm configuration said it would. Client policies are the control that requires PKCE, blocks implicit flow, or asserts FAPI. A policy that does not fire is a paper control. Red Hat patched in 2026. Keycloak advisories in the same period also document a WebAuthn attestation-policy bypass (fmt:none).
Why it matters
Most Keycloak hard-won lessons live in client policies, not in the default realm. If those policies are skippable, every "we are FAPI-grade" statement in an audit package is wrong.
What to do
- Upgrade Keycloak to the 2026 build that names CVE-2026-18207.
- Add a test client that violates each policy (no PKCE, implicit,
fmt:none) and assert it is rejected. - Read the OAuth 2.0 pitfalls section before you relax a policy to "make a vendor integration work."
Sources
- NVD: CVE-2026-18207
- Red Hat Keycloak advisories, including WebAuthn
fmt:none
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.