CVE-2026-18215

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description Keycloak allows users to authenticate using Microsoft accounts with restrictions limited to a specific organization (tenant). A flaw exists where this tenant restriction is ignored during the token exchange process. This allows an attacker possessing a valid Microsoft token from an unrelated organization to bypass the restriction and gain unauthorized access to the Keycloak realm, which could lead to the exposure of sensitive data or unauthorized actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.