Executive brief
Keycloak is an open-source identity and access management system used by enterprises to manage user authentication and session management across applications. A flaw in the backchannel logout endpoint allows attackers to forcibly log out users when signature validation is disabled on an OIDC provider, disrupting user sessions and causing denial of service. This requires specific configuration (signature validation skipped) and knowledge of session details, limiting but not eliminating the risk to affected deployments.
Technical details
The vulnerability exists in the keycloak-services component's backchannel logout endpoint, which fails to validate cryptographic signatures on logout requests when an OIDC identity provider is configured to skip signature validation. The root cause is insufficient validation of the logout request integrity—the endpoint accepts unsigned logout messages that should require a valid signature. An attacker with knowledge of a target user's session details can send an unsigned backchannel logout request to force that user's session to be terminated. The vulnerability is network-accessible and requires no authentication from the attacker, but exploitation depends on a permissive OIDC provider configuration. Red Hat has assigned this CVE and patches are expected through normal update channels.
Affected products
- Red Hat Build of Keycloak <UNKNOWN>
Timeline
- 2026-08-04: disclosed