CVE-2026-18211: Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains
Vulnerability summary
CVE-2026-18211 is a medium (CVSS 5.4) Improper Input Validation vulnerability in redhat build_of_keycloak. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.2% of scored vulnerabilities.
Timeline
- 31-07-2026PublishedVulnerability first disclosed.
- 31-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA4.2MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
Increase +0.13 pp
From 0.18% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat1 product
1 vendor · 1 product