CVE-2026-18214 in Keycloak
Summary
by MITRE • 07/31/2026
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
This vulnerability represents a critical authorization bypass in Keycloak's identity management system that undermines the intended domain-based access controls for Google Workspace authentication. The flaw specifically affects configurations where administrators have implemented domain restrictions to limit user access to specific Google Workspace domains, creating a security gap in the token exchange process that should maintain these boundary checks.
The technical implementation issue stems from the token exchange mechanism failing to validate the originating domain of Google tokens during the conversion process from Google OAuth tokens to Keycloak session tokens. This represents a classic authorization flaw where the system trusts the token content without proper verification of the issuing domain, effectively allowing privilege escalation through unauthorized access paths. The vulnerability exists at the intersection of identity federation and access control enforcement, creating an unexpected trust relationship between domains that should remain separate.
Operationally, this vulnerability enables attackers to exploit valid Google credentials from unauthorized domains to gain access to Keycloak realms that should only permit users from specific Workspace domains. The impact extends beyond simple unauthorized access as it can lead to privilege escalation within the Keycloak environment, potentially allowing attackers to assume roles and permissions of legitimate users from authorized domains. This creates a significant risk for organizations relying on domain-based restrictions as part of their security posture.
The flaw manifests as a failure in the authentication flow where the token exchange process bypasses the domain validation logic that normally occurs during initial Google authentication. This represents a violation of the principle of least privilege and demonstrates poor separation of concerns in the identity management system. Organizations using Keycloak with Google Workspace integration may experience unauthorized access to sensitive resources, potentially compromising data integrity and confidentiality.
Mitigation strategies should focus on immediate patching of the token exchange functionality to enforce domain validation during token conversion processes. Administrators should implement additional monitoring for unauthorized access attempts and review existing domain restriction configurations to ensure proper enforcement. The vulnerability aligns with CWE-284 (Improper Access Control) and can be mapped to ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) where attackers leverage legitimate credentials from unauthorized domains to access restricted environments, making this a significant concern for cloud security posture management.