CVE-2026-18569

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak (affected versions not specified)

Description A flaw exists in the backchannel logout endpoint of the keycloak-services component, which manages authentication and session management. When an OpenID Connect (OIDC) identity provider is configured to skip signature validation, the system incorrectly accepts logout requests that lack a cryptographic signature. An attacker with specific technical details regarding a user session can exploit this to force a user logout, causing service disruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.