Bug 2509755 (CVE-2026-18569)

Summary:	CVE-2026-18569 keycloak-services: keycloak-services: OIDC backchannel logout accepts unsigned forged logout tokens
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anujha, aschwart, asoldano, aszczucz, bbaranow, bmaxwell, boliveir, bstansbe, dlofthou, drichtar, istudens, ivassile, iweiss, mosmerov, mposolda, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rmartinc, rstancel, ssilvert, sthorger, thjenkin, vdosoudi, vmuzikar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this flaw to force that user to be logged out, potentially disrupting their work.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-31 12:24:41 UTC

A flaw was found in the keycloak-services component of Keycloak. The vulnerability exists in the OIDC backchannel logout endpoint located at /realms/realm/protocol/openid-connect/logout/backchannel-logout. When an OIDC identity provider is configured with validateSignature set to false, the endpoint fails to enforce cryptographic signature requirements for logout tokens, accepting tokens with the alg=none header.
An unauthenticated remote attacker who knows the provider issuer, the broker client ID, and a brokered user's upstream subject or session ID can craft and send a forged, unsigned logout token. Successful exploitation allows the attacker to force-logout targeted brokered users or revoke their offline sessions. This behavior violates the OIDC Back-Channel Logout specification which mandates signatures and prohibits the use of the none algorithm.