CVE-2026-18573: Keycloak Client Access-Type Policy Bypass Vulnerability
Summary
CVE-2026-18573: Keycloak-services: keycloak-services: client access-type policy condition bypass during client update. Affects keycloak versions < 26.7.3. Fixed in 26.7.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution designed for modern applications and services. It provides features such as single sign-on (SSO), user federation, identity brokering, and social login. The keycloak-services component is responsible for managing authentication and authorization flows, allowing administrators to enforce security policies for client applications. However, a flaw in this component can lead to significant security risks if not addressed.
Vulnerability Detail
A flaw was identified in the keycloak-services component of Keycloak, which allows an attacker with client management permissions to bypass security policies during client updates. When a realm administrator sets client policies for confidential clients, the improper evaluation of client state during an update operation enables an attacker to create a public client and subsequently change it to a confidential client with weaker authentication requirements. This vulnerability can lead to the persistence of clients that do not adhere to the intended security hardening of the realm, potentially exposing sensitive data and compromising the security posture of the application.
How To Fix
Minimum fixed version
26.7.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can manually monitor client configurations and restrict client management permissions to trusted users only. Additionally, avoid creating public clients if not necessary, and regularly audit client settings to ensure compliance with security policies.
Conclusion
The CVE-2026-18573 vulnerability in Keycloak's keycloak-services component poses a significant risk by allowing unauthorized bypass of client access-type policies. It is crucial for users to update to the patched version 26.7.3 or later to mitigate this risk. Regular audits and restricted permissions can serve as interim measures until the update is applied.
See every vulnerability recorded for keycloak →
FAQ
CVE-2026-18573 is a vulnerability in the keycloak-services component of Keycloak that allows an attacker to bypass client access-type policies during client updates.
Any organization using Keycloak with client management permissions configured may be affected, particularly those who have not updated to version 26.7.3 or later.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By using the manifest file like package-lock.json, Vulert can help you identify if your application is impacted by this vulnerability.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, as clients may operate with weaker authentication requirements, undermining the security of the entire realm.
Yes, you can restrict client management permissions to trusted users and regularly audit client configurations to ensure compliance with security policies as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for keycloak.
