CVE-2026-18569 is a vulnerability in Red Hat Build of Keycloak's keycloak-services component affecting the backchannel logout endpoint. When an OpenID Connect (OIDC) identity provider is configured to skip signature validation—a non-default and insecure configuration—the system improperly accepts logout requests lacking cryptographic signatures. An attacker who knows specific session identifiers can exploit this flaw to force targeted users to log out, resulting in a limited denial of service. Red Hat has assessed the severity as low due to the requirement for a non-default configuration and session knowledge. No official fix or mitigation is currently provided by Red Hat, and users are advised to avoid insecure configurations that disable signature validation.

The vulnerability allows an attacker to forcibly log out users by sending unsigned logout requests accepted due to disabled signature validation in the OIDC identity provider configuration. This leads to a limited denial of service affecting targeted users' sessions. There is no impact on confidentiality or integrity, and no privilege escalation or code execution is involved. Exploitation requires knowledge of specific session identifiers and a non-default insecure configuration, limiting the scope and ease of exploitation.

Red Hat currently does not provide an official fix or mitigation that meets their criteria for ease of use, applicability, and stability. The primary mitigation is to avoid configuring the OIDC identity provider to skip signature validation, as this insecure setting enables the vulnerability. Users should ensure signature validation is enabled to prevent acceptance of unsigned logout requests. Monitor Red Hat advisories for any future updates or patches addressing this issue.