Vulnerability in Red Hat Build Of Keycloak
CVE-2026-18569
A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.
EPSS: 0.002 (5.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry, Vendor Advisory)
- RHBZ#2509755 (x_refsource_REDHAT, issue-tracking, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-18569?
- CVE-2026-18569 is a low-severity vulnerability in Red Hat Build Of Keycloak, classified under Improper Verification of Cryptographic Signature. CVSS score: 3.7/10. Published 2026-08-04.
- How severe is CVE-2026-18569?
- Low severity. CVSS v3 base score is 3.7 out of 10.