Bug 2508309 (CVE-2026-18215)

Summary: CVE-2026-18215 keycloak-services: keycloak-services: Microsoft external access-token exchange bypasses configured tenant
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-29 08:47:39 UTC 
A flaw was found in the Microsoft social identity provider in Keycloak. When a Microsoft identity provider is configured with a specific tenant ID, the restriction is correctly enforced for standard browser-based logins. However, the external access-token exchange endpoint fails to perform this validation.
The root cause is that Keycloak calls the tenant-agnostic Microsoft Graph /me endpoint during the exchange process. It accepts the returned user profile and issues Keycloak tokens without verifying that the tenant associated with the original Microsoft token matches the configured tenant ID in the identity provider settings.
An attacker with a valid Microsoft Graph access token from an arbitrary tenant can submit it to the Keycloak token exchange endpoint. Successful exploitation allows the attacker to bypass tenant restrictions, assume an identity within the Keycloak realm, and perform actions with the privileges of that identity, such as accessing protected resources or modifying user data.