CVE-2026-18569 : A flaw was found in the keycloak-services component of Keycloak. The vulnerability exists in the OIDC backchannel logout endpoint located at /realms/realm/protocol/openid-connect/logout/backchannel-logout. When an OIDC identity provider is configured with validateSignature set to false, the endpoint fails to enforce cryptographic signature requirements for logout tokens, accepting tokens with the alg=none header. An unauthenticated remote attacker who knows the provider issuer, the broker client ID, and a brokered user's upstream subject or session ID can craft and send a forged, unsigned logout token. Successful exploitation allows the attacker to force-logout targeted brokered users or revoke their offline sessions. This behavior violates the OIDC Back-Channel Logout specification which mandates signatures and prohibits the use of the none algorithm.
This issue was originally tracked in the private repository. Migrated by @ahus1 .
ahus1 added area/oidc OpenID Connect / OAuth 2.0 — tokens, endpoints, scopes, DCR, PAR, DPoP OpenID Connect / OAuth 2.0 — tokens, endpoints, scopes, DCR, PAR, DPoP priority/important Must be worked on very soon Must be worked on very soon area/identity-brokering Identity brokering — external IdPs (social, OIDC, SAML), account linking Identity brokering — external IdPs (social, OIDC, SAML), account linking kind/cve Issues identified as CVEs on third-party dependencies, or issues which Keycloak is not affected Issues identified as CVEs on third-party dependencies, or issues which Keycloak is not affected backport/main backport/26.6 team/core-protocols backport/26.7 on Aug 3, 2026
ahus1 added the cve issue type on Aug 3, 2026
keycloak-github-bot added team/core-iam on Aug 3, 2026
sguilhen removed team/core-iam on Aug 3, 2026
pedroigor assigned tkyjovsk on Aug 24, 2026
stianst added this to Keycloak Roadmap on Sep 10, 2026
github-project-automation moved this to Backlog in Keycloak Roadmap on Sep 10, 2026
github-project-automation moved this from Backlog to In progress in Keycloak Roadmap on Sep 10, 2026
stianst added this to Keycloak Roadmap on Sep 10, 2026
abstractj added severity/medium 50 calendar days to fix 50 calendar days to fix on Sep 30, 2026
stianst added backport/26.8 and removed backport/26.7 on Oct 1, 2026
pedroigor added a commit that references this issue on Oct 5, 2026 Enforce signature validation for back-channel logout tokens even when… This issue will close once commit e4cdb5e is merged into the 'main' branch. e4cdb5e
Enforce signature validation for back-channel logout tokens even when…
pedroigor closed this as completed in #52171 on Oct 5, 2026
github-actions added release/27.0.0 and removed backport/main on Oct 5, 2026
mposolda added team/core-iam and removed team/core-protocols on Oct 6, 2026
github-actions added release/26.8.1 release/26.6.8 and removed backport/26.8 backport/26.6 on Oct 9, 2026
Keycloak Roadmap Status Done Show more project fields
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
