CVE-2026-18206

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the keycloak-services component of Keycloak, which manages identity and access. The issue arises when a realm administrator implements a wildcard domain (e.g., *.example.com) to restrict hosts authorized to register or update clients. Due to improper validation, the system accepts any hostname ending with the specified domain suffix, regardless of whether it is a legitimate subdomain. An attacker capable of controlling the reverse DNS of their connection can bypass these host-based restrictions to potentially perform unauthorized client modifications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.