CVE-2026-18214 — Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange…
Published: 2026-07-31 · CVSS: 6.8 · CVSS 3.1
Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7