CVE-2026-18209
LowCVSS 3.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
In the keycloak-services component of Keycloak, the security check preventing HTTP parameter pollution only inspects the query portion of a redirect URL, ignoring the fragment. When a client is configured with a wildcard redirect URI, an attacker can inject duplicate security parameters into the login response. If the client application is not configured correctly, it might trust the attacker's injected data instead of real security information from Keycloak, leading to session fixation or account confusion.
Risk Assessment
An attacker can hijack a user's session or cause account confusion, enabling unauthorized access to data and functions.
Recommendation
Update Keycloak to a version that fixes this vulnerability. Ensure client applications are properly configured to handle security parameters.
Original NVD description (English source)
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.