THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-18209 (LOW 3.4) — A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fr

[NVD] CVE-2026-18209 (LOW 3.4) — A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fr

lownvdPublished 2026-07-31

CVE-2026-18209 CVSS: 3.4 LOW Published: 2026-07-31T08:16:27.467

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wild

Indicators of compromise

CVE-2026-18209cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-18209