CVE-2026-18573: Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

A state-based policy bypass vulnerability was discovered in Keycloak's client policy engine. The flaw exists in the way the access-type condition evaluates UPDATE operations. Specifically, the condition checks the old client state instead of the proposed new state during an update. An attacker with low privileges, such as delegated client management permissions or a valid dynamic registration token, can exploit this by creating a public client and subsequently updating it to a confidential client. Because the policy engine still perceives the client as public during the update process, it fails to trigger the confidential-client policy profile. This allows the attacker to configure a confidential client with weak authentication (e.g., client-secret) even when the realm policy mandates stronger methods like client-jwt. Successful exploitation allows an attacker to persist non-compliant confidential clients, undermining realm-level security hardening.

— Red Hat