CVE-2026-18215 in Keycloak
Summary
by MITRE • 07/31/2026
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
This vulnerability exists within Keycloak's authentication system where the platform supports Microsoft account logins with organizational tenant restrictions. The flaw specifically manifests in the token exchange functionality which should enforce the originally specified tenant boundaries but fails to do so properly. When users authenticate through Microsoft accounts, Keycloak is designed to validate that the user belongs to a pre-approved organization or tenant before granting access to the realm. However, the token exchange mechanism bypasses this validation check, allowing cross-tenant access to occur.
The technical implementation issue stems from improper validation of the Microsoft tenant identifier during the token exchange process. When a valid Microsoft authentication token is presented, the system should verify that the token's tenant matches the configured allowed tenant for that particular Keycloak realm. This validation step becomes critical when using the token exchange feature because it enables other applications or services to obtain tokens on behalf of users, but without proper tenant verification, an attacker can leverage a valid token from any Microsoft organization to access resources within a different organization's Keycloak realm.
This vulnerability creates significant operational risks as it allows attackers to perform privilege escalation attacks through cross-tenant token manipulation. An attacker who successfully exploits this flaw could gain unauthorized access to sensitive data, perform administrative actions, or potentially pivot to other systems within the compromised realm. The impact extends beyond simple unauthorized access since the attacker can leverage legitimate authentication tokens from different organizations to move laterally within the Keycloak infrastructure.
The vulnerability aligns with CWE-284 Access Control Issues and specifically relates to improper access control enforcement during token exchange operations. From an ATT&CK perspective, this maps to privilege escalation techniques where adversaries exploit weak validation controls in authentication systems to gain access to resources they should not be able to reach. The attack vector involves token manipulation where the attacker exchanges a valid Microsoft token from one tenant for access to another organization's Keycloak realm.
Security mitigations should focus on implementing strict tenant validation during all token exchange operations and ensuring that the original authentication context is preserved throughout the exchange process. Organizations should configure proper access controls and implement additional verification steps before allowing token exchanges to proceed. Regular security testing of authentication flows, particularly around token handling and exchange mechanisms, should be conducted to identify similar issues. Additionally, monitoring for unusual token exchange patterns and implementing least-privilege principles can help reduce the potential impact of such vulnerabilities in production environments.