IDN Homograph Attack Vulnerability in Keycloak
Summary
GHSA-mwm4-5qwr-g9pf: Keycloak is vulnerable to IDN homograph attack. Affects org.keycloak:keycloak-services versions < 18.0.0. Fixed in 18.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides single sign-on capabilities for web applications. It is designed to secure applications by managing user authentication, authorization, and user account management. Keycloak is written in Java and is widely used in enterprise environments. However, a vulnerability has been discovered in Keycloak that allows for IDN homograph attacks.
Vulnerability Detail
The IDN homograph attack vulnerability in Keycloak allows a malicious user to register a name that appears identical to an existing name but is actually composed of different characters. This can trick an administrator into granting extra privileges to the attacker's account. The vulnerability poses a threat to the integrity of the system, as it can lead to unauthorized access and potential data breaches.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
18.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of Keycloak.
Conclusion
The IDN homograph attack vulnerability in Keycloak poses a risk to the integrity of the system. It is crucial to upgrade to the latest version of Keycloak (18.0.0 or later) to patch the vulnerability and ensure the system is secure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
An IDN homograph attack is a type of attack where a malicious user registers a domain or username that appears visually identical to a legitimate domain or username. This is achieved by using characters from different character sets that look similar. The purpose of such an attack is to deceive users or administrators into believing they are interacting with a trusted entity.
In Keycloak, an IDN homograph attack can allow an attacker to register a name that appears identical to an existing name and trick an administrator into granting extra privileges to the attacker's account. This can lead to unauthorized access, data breaches, and potential compromise of the entire system.
You can use the Vulert Playground at Vulert Scanner to check if your Keycloak installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it to identify any open-source vulnerabilities, including the IDN homograph attack vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade to the latest version of Keycloak to ensure the vulnerability is patched and the system is secure.
You can find more information about the IDN homograph attack vulnerability in Keycloak in the official Keycloak documentation, security advisories, and the GitHub repository for Keycloak.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
