CVE-2026-18569
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A flaw in the backchannel logout endpoint of the keycloak-services component (part of Red Hat Build of Keycloak) allows the system to incorrectly accept logout requests without a cryptographic signature when an OIDC identity provider is configured to skip signature validation. An attacker knowing session details can force a user to be logged out.
Risk Assessment
An attacker can disrupt users' work by forcing them to log out, potentially leading to work interruptions and potential data loss during sessions.
Recommendation
Configure the OIDC provider to not skip signature validation and apply vendor-provided patches.
Original NVD description (English source)
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.