Technical impact
The vulnerability lies in the keycloak-services component of the Red Hat build of Keycloak. During backchannel logout, the system incorrectly accepts logout requests that have no cryptographic signature when the OIDC identity provider is configured to skip signature validation. This flaw allows an attacker who knows certain technical details about a user’s session to forge an unsigned logout token and force that user to be logged out, disrupting their work. The weakness is a misuse of authentication tokens without proper validation (CWE‑347).
Affected Systems
Affected systems are deployments that use the Red Hat build of Keycloak and have enabled backchannel logout with an OIDC identity provider configured to skip signature verification. The keycloak-services component handles authentication and session management, so any application integrating with this component is potentially impacted. No specific version range is listed in the advisory, so all currently supported releases without the applied fix remain vulnerable until patched.
Risk and Exploitability
The CVSS score of 3.7 denotes a moderate severity. Because the EPSS score is not available, the exact likelihood of exploitation is unclear, but the requirement of a misconfigured identity provider lowers the risk compared to an arbitrary attacker. The exposure is limited to users whose sessions can be targeted, so the impact is user‑level service disruption rather than a system‑wide compromise. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is reported. Based on the description, it is inferred that the attacker must forge and transmit an unsigned logout token to the endpoint. Thus, the main vector is remote authentication abuse via a weakly validated logout request.
