Improper Hostname Validation

org.keycloak, keycloak-services is vulnerable to improper hostname validation. The vulnerability is due to improper validation of wildcard domain suffixes, which allows an attacker who controls the reverse DNS of their connection to bypass host-based restrictions and perform unauthorized client...

CVE-2026-18206: Improper Input Validation

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain like .example.com to restrict which hosts can register or update clients. Due to improper validation, the...