CVE-2026-18209 | BDVDB-2026-354375 Detail

Description#

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-31Record published in the CVE List.
2. Version 22026-09-16Most recent update recorded in the CVE List.