CVE-2026-18209
LOWDescription
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
Is your site exposed to CVE-2026-18209?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-18209? +
How severe is CVE-2026-18209? +
How do I check if I'm vulnerable to CVE-2026-18209? +
Related Vulnerabilities
Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the …
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.
A command injection vulnerability exists in local RACADM. A malicious authenticated user could gain control of the underlying operating system.
Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and …
Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to bypass a security feature over a …