The vulnerability occurs due to improper evaluation of client state during update operations in Keycloak's client policy enforcement. Specifically, when a realm administrator configures client policies to enforce authentication requirements on confidential clients, an attacker can circumvent these policies by first creating a public client and subsequently updating it to a confidential client with reduced authentication controls. This flaw enables persistence of clients that violate the realm's security hardening policies, potentially weakening the overall authentication and authorization framework.

An attacker with client management permissions can bypass configured client authentication policies, leading to the persistence of clients with weaker authentication than intended. This compromises the integrity of the realm's security policies, potentially allowing unauthorized access or reduced security assurance for confidential clients. The vulnerability does not impact confidentiality or availability directly but has a high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-18573 for current remediation guidance. No official fix or workaround is documented in the provided information. Until a patch is available, restrict client management permissions to trusted administrators only to reduce risk.