CVE-2026-18569: Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
Vulnerability summary
CVE-2026-18569 is a low (CVSS 3.7) vulnerability in redhat build_of_keycloak. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.4% of scored vulnerabilities.
Timeline
- 04-08-2026PublishedVulnerability first disclosed.
- 31-08-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
Increase +0.09 pp
From 0.16% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat1 product
1 vendor · 1 product