Missing Authorization in Keycloak - CVE-2026-18573
Published: August 2, 2026 / Updated: September 5, 2026
Vulnerability identifier: #VU146980
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-18573
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass client authentication policies.
The vulnerability exists due to improper authorization in the keycloak-services component when updating a public client to a confidential client. A remote user can create a public client and update it to a confidential client with weaker authentication to bypass client authentication policies.
Exploitation requires client management permissions and realm client policies that enforce authentication requirements on confidential clients.
Affected software
Keycloak
How to mitigate CVE-2026-18573
Install security update from vendor's website.
Keycloak - update to 26.7.3