CVE-2026-18570: Keycloak Package Suffers from Client Policy Validation Bypass
Summary
CVE-2026-18570: A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. Affects keycloak versions < 26.7.3. Fixed in 26.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows users to secure applications and services with little to no code. It provides features such as single sign-on (SSO), identity brokering, and user federation. The keycloak-services component is responsible for enforcing security policies during client registration and configuration. This component is crucial for maintaining the integrity of client access and permissions within the Keycloak ecosystem.
Vulnerability Detail
A flaw exists in the full-scope-disabled client-policy executor within the keycloak-services component. The issue arises because the executor only checks the fullScopeAllowed field when it is explicitly included in a request. If this field is omitted, a delegated user can bypass the policy, leading to the creation of a client with full scope access. This vulnerability allows the client to obtain tokens with unauthorized role mappings, potentially compromising sensitive data and access controls.
How To Fix
Minimum fixed version
26.7.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the fullScopeAllowed field is always included in requests when registering clients. This can help mitigate the risk of unauthorized access until the package is updated.
Conclusion
CVE-2026-18570 represents a significant security risk for applications using the Keycloak package. It is crucial to update to the latest version to mitigate this vulnerability. Implementing the recommended fixes and workarounds will help secure your application against unauthorized access.
See every vulnerability recorded for keycloak →
FAQ
CVE-2026-18570 is a vulnerability in the Keycloak package that allows a client policy validation bypass, potentially leading to unauthorized access.
If your application uses Keycloak and is affected by this vulnerability, it may allow unauthorized clients to obtain tokens with elevated permissions.
You can implement a workaround by ensuring that the fullScopeAllowed field is included in all client registration requests.
Detailed information can be found in the vulnerability database and the official Keycloak documentation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for keycloak.
