Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-18211 A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on … https://www.cve.org/CVERecord?id=CVE-2026-18211
Post summary
The text briefly notes the discovery of a flaw in the Keycloak secure-client-uris executor but provides no detailed technical info, PoC, exploit, or patch details.
🚨*CVE* CVE-2026-18211 A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on … https://www.cve.org/CVERecord?id=CVE-2026-18211 ----- Traducción: Se encontró una fa… http://infoflow.cloud`
Post summary
The post announces the discovery of a flaw in Keycloak’s secure‑client‑uris policy executor, providing limited technical context but no evidence of exploitation, patches, or PoC.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | redhat | build_of_keycloak | - | - | - |