Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-28T13:36:46 keycloak-services: keycloak-services: Client policy source-host wildcard domain matching bypass 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CWE-20

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.

The Red Hat Product Security team has assessed the severity of this vulnerability as Low, given that exploitation requires a specific administrative configuration and attacker control over reverse DNS resolution. Successful exploitation allows an attacker to bypass host-based restrictions for client registration and update operations. The vulnerability's root cause is improper validation of wildcard domain matches in the keycloak-services component, which fails to enforce proper subdomain boundaries. Red Hat would like to thank Paul Bottinelli (Trail of Bits) for reporting this issue. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Build of Keycloak Affected keycloak-services Red Hat Build of Keycloak Affected rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Data Grid 8 Not affected keycloak-services Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected keycloak-services Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-18206 https://nvd.nist.gov/vuln/detail/CVE-2026-18206