The vulnerability in Red Hat Build of Keycloak involves improper authentication logic related to Microsoft account login restrictions. Specifically, when using the token exchange feature, the tenant restriction that should limit access to a particular organization is ignored. This allows an attacker possessing a valid Microsoft token from an unrelated organization to gain access to the Keycloak realm. The issue could lead to unauthorized access to sensitive information or unauthorized operations within the affected Keycloak instance. The CVSS 3.1 base score is 6.8, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high confidentiality and integrity impacts with no availability impact. The vendor advisory does not provide explicit patch or remediation details at this time.

An attacker with a valid Microsoft token from a different organization can bypass tenant restrictions in Keycloak's Microsoft login integration via the token exchange feature. This could result in unauthorized access to the Keycloak realm, potentially exposing sensitive data or allowing unauthorized actions. The confidentiality and integrity of the system are impacted, while availability is not affected.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18215 for current remediation guidance. No official fix or workaround is currently documented in the provided data.