CVE-2026-18214
MEDIUMKeycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction
Title source: cnaDescription
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.
References (2)
Core 2
Core References
Vdb Entry, X_Refsource_Redhat vdb-entry
x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-18214
Issue Tracking, X_Refsource_Redhat issue-tracking
x_refsource_redhat
RHBZ#2508308
https://bugzilla.redhat.com/show_bug.cgi?id=2508308
Scores
CVSS v3
6.8
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-862
Status
published
Products (4)
Red Hat/Red Hat Build of Keycloak
Red Hat/Red Hat Data Grid 8
Red Hat/Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat/Red Hat Single Sign-On 7
Published
Jul 31, 2026
Tracked Since
Jul 31, 2026