CVE-2026-18209: Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

Vulnerability summary

CVE-2026-18209 is a medium (CVSS 4.7) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.9% of scored vulnerabilities.

Timeline

1. 31-07-2026
   PublishedVulnerability first disclosed.
2. 16-09-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.

• CWE-1288Improper Validation of Consistency within InputThe product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.