Executive brief
Keycloak, an open-source identity and access management solution, contains a security flaw in how it handles Google account logins. While administrators can configure the system to only allow users from specific Google Workspace domains, a bypass exists when using the 'token exchange' feature. This could allow an unauthorized individual with a valid Google account from a different organization to gain access to protected corporate resources and data.
Technical details
A missing authorization vulnerability (CWE-862) exists in the Keycloak Google Identity Provider implementation when the Token Exchange V1 feature is enabled. While the standard Google ID-token login flow correctly validates the 'hd' (hosted domain) claim, the external access-token exchange path skips this validation. When an external access token is provided, Keycloak retrieves the user profile from the Google user-info endpoint but fails to verify that the user's domain matches the 'hostedDomain' restriction configured in the Identity Provider settings. An attacker with a valid Google access token and access to a confidential client authorized for token exchange can bypass these restrictions to obtain a Keycloak access token.
Affected products
- Red Hat Build of Keycloak unspecified
- Keycloak Keycloak unspecified
Timeline
- 2026-07-29: disclosed: Reported via Red Hat Bugzilla
- 2026-07-31: advisory: NVD publication date