CVE-2026-18209: Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
Other sources
An incomplete fix for CVE-2026-9689 was identified in Keycloak's RedirectUtils.containsForbiddenOidcParameters() method. While the original fix successfully blocks forbidden OIDC parameters (such as code, state, and iss) in the URI query string, it fails to inspect the URI fragment (#). When a client is configured with a wildcard redirect URI, an attacker can supply a redirecturi containing these forbidden parameters within the fragment. Because matchesRedirects strips fragments during prefix matching, the crafted URI is accepted. During the authorization response, Keycloak appends its own parameters to the attacker-supplied fragment, leading to a polluted response where attacker-controlled values appear first. Exploitation Conditions: The target client must have a wildcard-registered redirect URI (e.g., https://app.example.com/).
The attacker must induce a victim to follow a crafted authorization URL.
The relying party (client application) must use a first-wins parsing strategy for duplicate parameters.
Concrete Impact: Injection of attacker-controlled iss (issuer), state, and accesstoken parameters.
Potential for session fixation or account confusion if the relying party does not validate parameters per RFC 9207.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18209?
The severity of CVE-2026-18209 is rated as low with a score of 3.4.
How do I fix CVE-2026-18209?
To fix CVE-2026-18209, ensure that the Keycloak services are updated to the latest version where the vulnerability is addressed.
What components of Keycloak are affected by CVE-2026-18209?
CVE-2026-18209 affects the keycloak-services component of Keycloak that handles OpenID Connect authentication.
What kind of attack does CVE-2026-18209 facilitate?
CVE-2026-18209 facilitates HTTP parameter pollution attacks through manipulation of the redirect_uri fragment.
When was CVE-2026-18209 published?
CVE-2026-18209 was published on July 29, 2026.