CVE-2026-18214
Received Received - Intake

Keycloak Google Token Exchange Domain Bypass

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Red Hat, Inc.

Description
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-18214
EUVD
EUVD-2026-51485

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
keycloak keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Keycloak has a flaw in its token exchange feature where it fails to enforce domain restrictions when swapping a Google token for a Keycloak token. This allows attackers with valid Google accounts from unauthorized domains to bypass security checks and gain access to restricted Keycloak realms.

Detection Guidance

Check Keycloak server logs for unusual token exchange requests or failed domain validation attempts. Look for Google tokens being swapped for Keycloak tokens from unauthorized domains.

Impact Analysis

If you use Keycloak with Google Workspace domain restrictions, an attacker could exploit this flaw to access your Keycloak realm even if their Google account is not part of your allowed domains. This could lead to unauthorized access to sensitive data or applications.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls, such as GDPR's data protection principles or HIPAA's access safeguards. Unauthorized access risks data breaches, leading to potential legal and regulatory penalties.

Mitigation Strategies
  • Update Keycloak to the latest version that patches this issue.
  • Review and enforce domain restrictions in Keycloak configuration for Google Workspace logins.
  • Monitor logs for any unauthorized access attempts or successful bypasses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart