Executive brief
Keycloak, an open-source identity and access management solution, contains a flaw in how it handles Microsoft account logins. While administrators can configure Keycloak to only allow users from a specific Microsoft organization (tenant), this restriction is ignored when using the 'token exchange' feature. An attacker with a valid Microsoft account from any organization could bypass these security settings to gain unauthorized access to the system, potentially leading to data theft or unauthorized administrative actions.
Technical details
An improper authentication vulnerability (CWE-287) exists in the Keycloak 'keycloak-services' component specifically within the Microsoft social identity provider implementation. While standard browser-based logins correctly enforce configured tenant ID restrictions, the external access-token exchange endpoint fails to perform this validation. The root cause is that Keycloak utilizes the tenant-agnostic Microsoft Graph '/me' endpoint during the exchange process and issues Keycloak tokens without verifying that the tenant associated with the provided Microsoft token matches the provider's configuration. An attacker with a valid Microsoft Graph access token from any arbitrary tenant can exploit this to bypass tenant isolation and assume an identity within the Keycloak realm.
Affected products
- Red Hat Build of Keycloak unspecified
Timeline
- 2026-07-29: disclosed: Reported via Red Hat Bugzilla
- 2026-07-31: advisory: NVD publication date