CVE-2026-18206
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Keycloak's keycloak-services component, a realm administrator can use a wildcard domain (e.g., *.example.com) to restrict client registration. Due to improper validation, the system accepts any hostname ending with the domain suffix, even if not a legitimate subdomain. An attacker controlling reverse DNS can bypass these restrictions and potentially make unauthorized client modifications.
Risk Assessment
The risk is that an attacker can bypass host-based restrictions, leading to unauthorized changes in Keycloak client configurations, potentially compromising identity management integrity and security.
Recommendation
Upgrade Keycloak to a version with the fix for wildcard domain validation and avoid using wildcards in host restriction configurations where possible.
Original NVD description (English source)
A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.