CVE-2026-18215

CVE-2026-18215 affects Keycloak (Keycloak-services) where the tenant-restriction for Microsoft accounts is bypassed via the token-exchange feature. A valid Microsoft token from a different organization can be used to access the Keycloak realm, potentially exposing sensitive data or enabling unaut...