[NVD] CVE-2026-18215 (MEDIUM 6.8) — Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token fr

CVE-2026-18215 CVSS: 6.8 MEDIUM Published: 2026-07-31T08:16:27.893

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain ac