CVE-2026-18214

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description Keycloak allows authentication via Google accounts and can be restricted to specific Google Workspace domains. A flaw exists in the token exchange feature, which enables the swapping of a Google token for a Keycloak token, as it fails to enforce these domain restrictions. Consequently, an attacker possessing a valid Google account from an unauthorized domain can bypass the security check to gain access to the Keycloak realm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.