CVE-2026-18569: Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
Other sources
A flaw was found in the keycloak-services component of Keycloak. The vulnerability exists in the OIDC backchannel logout endpoint located at /realms/realm/protocol/openid-connect/logout/backchannel-logout. When an OIDC identity provider is configured with validateSignature set to false, the endpoint fails to enforce cryptographic signature requirements for logout tokens, accepting tokens with the alg=none header. An unauthenticated remote attacker who knows the provider issuer, the broker client ID, and a brokered user's upstream subject or session ID can craft and send a forged, unsigned logout token. Successful exploitation allows the attacker to force-logout targeted brokered users or revoke their offline sessions. This behavior violates the OIDC Back-Channel Logout specification which mandates signatures and prohibits the use of the none algorithm.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the OIDC identity provider is configured with validateSignature=true so the /realms/realm/protocol/openid-connect/logout/backchannel-logout endpoint enforces cryptographic signature validation and does not accept unsigned forged logout tokens (alg=none).
Keycloak (keycloak-services) OIDC identity provider configuration validateSignature = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18569?
The severity of CVE-2026-18569 is classified as low with a score of 3.7.
How do I fix CVE-2026-18569?
To mitigate CVE-2026-18569, ensure that the OIDC identity provider is configured to verify the signatures of logout tokens.
What component is affected by CVE-2026-18569?
CVE-2026-18569 affects the keycloak-services component of the Red Hat Build of Keycloak.
What type of vulnerability is CVE-2026-18569?
CVE-2026-18569 is a vulnerability in the backchannel logout endpoint that accepts unsigned forged logout tokens.
When was CVE-2026-18569 published?
CVE-2026-18569 was published on July 31, 2026.