The vulnerability in Red Hat Build of Keycloak arises from improper validation of wildcard domain restrictions used by realm administrators to limit client registration or updates. Specifically, when a wildcard domain such as *.example.com is set, the system accepts any hostname ending with 'example.com' regardless of legitimacy as a subdomain. This flaw enables an attacker who can manipulate their reverse DNS to circumvent host-based restrictions, potentially allowing unauthorized client modifications. The CVSS 3.1 base score is 3.7, indicating low severity, with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. There is no vendor advisory indication of a patch or remediation level, and no known exploits in the wild have been reported.

An attacker able to control the reverse DNS of their connection can bypass host-based client registration or update restrictions configured with wildcard domains. This may allow unauthorized modifications to clients within Keycloak realms. The impact is limited to integrity with low severity and does not affect confidentiality or availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18206 for current remediation guidance. Until an official fix is available, administrators should avoid relying solely on wildcard domain restrictions for host validation or implement additional validation controls to mitigate unauthorized client modifications.