CVE-2026-18573

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the keycloak-services component, used for managing authentication and authorization flows, allows a bypass of client access-type policy conditions. When a realm administrator enforces specific authentication requirements on confidential clients, an attacker with client management permissions can circumvent these policies. This is achieved by creating a public client and subsequently updating it to a confidential client with weaker authentication, leading to the persistence of clients that do not meet the realm's security hardening standards.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.