Low [CVE-2026-18206] Client policy source-host wildcard domain matching bypass

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients.

Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications.

The Red Hat Product Security team has assessed the severity of this vulnerability as Low, given that exploitation requires a specific administrative configuration and attacker control over reverse DNS resolution. Successful exploitation allows an attacker to bypass host-based restrictions for client registration and update operations.

The vulnerability's root cause is improper validation of wildcard domain matches in the keycloak-services component, which fails to enforce proper subdomain boundaries. Weakness: CWE-20.

Affected Red Hat products: Red Hat Build of Keycloak. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected.

Red Hat does not currently list a fixing RHSA for this CVE.