CVE-2026-18209 Details

A vulnerability exists in the keycloak-services component of Keycloak, specifically within OpenID Connect (OIDC) authentication flows. The issue arises because the security mechanism intended to prevent HTTP parameter pollution only examines the query part of a redirect URL, neglecting the fragment section. This flaw allows an attacker to inject duplicate security parameters into the login response by exploiting clients with wildcard redirect URIs. If the client application is misconfigured, it may accept the injected data from the attacker instead of the authentic security information from Keycloak, potentially causing session fixation or account confusion.