CVE-2026-18569 is a security flaw in the backchannel logout endpoint of the keycloak-services component within the Red Hat Build of Keycloak. When an OpenID Connect (OIDC) identity provider is configured to skip signature validation, the system erroneously accepts logout requests lacking cryptographic signatures. This improper verification allows an attacker who knows certain session identifiers to force targeted users to log out, disrupting their sessions. The vulnerability stems from failure to enforce signature validation on backchannel logout tokens under this specific configuration. Red Hat has assessed the issue as low severity due to the requirement for a non-default insecure setup and session knowledge. No patch or mitigation meeting Red Hat's criteria is currently available.

The vulnerability allows an attacker to force logout targeted users by sending unsigned logout requests when the OIDC identity provider is configured to skip signature validation. This results in a limited denial of service affecting the availability of user sessions. There is no impact on confidentiality or integrity. Exploitation requires network access, high attack complexity, no privileges, and no user interaction. The overall impact is low.

Red Hat currently does not provide a fix or mitigation that meets its criteria for ease of use, applicability, or stability. The vulnerability requires a non-default insecure configuration to be exploitable. Users should avoid configuring OIDC identity providers to skip signature validation to prevent exposure. Monitor Red Hat advisories for updates regarding patches or mitigations.