Executive brief
Keycloak, an identity and access management tool, contains a flaw in how it validates trusted domains for client registration. Administrators can set rules to only allow client updates from specific domains (like *.example.com), but the system incorrectly accepts any domain that simply ends with those letters (like 'maliciousexample.com'). This could allow an attacker who controls certain network settings to bypass these security restrictions and modify client configurations without authorization.
Technical details
An improper input validation vulnerability (CWE-20) exists in the 'ClientUpdaterSourceHostsCondition' component of Keycloak. When a wildcard domain (e.g., *.example.com) is used to restrict client registration or updates, the system performs a simple suffix match without verifying the subdomain boundary (the preceding dot). An unauthenticated attacker who controls the reverse DNS (PTR record) of their connecting IP can craft a hostname that ends in the trusted suffix (e.g., 'attacker-example.com') to bypass these restrictions. This allows the attacker to satisfy policy conditions and potentially perform unauthorized client modifications. The attack complexity is high as it requires the attacker to control reverse DNS for their source IP.
Affected products
- Red Hat Keycloak unspecified
- Red Hat Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-29: disclosed: Reported via Red Hat Bugzilla
- 2026-07-31: advisory: NVD published date