Skip to content
fr Sign in
3.1 Low

CVE-2026-94218 A flaw was found in the authentication session management of Keycloak, an identity and access management solution

Description

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.

Affected products and versions

Product Affected versions Fixed in
Red Hat Build of Keycloak Versions not published
Red Hat Single Sign-On 7 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Build of Keycloak

The 266 CVEs of Red Hat Build of Keycloak →
CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 High CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover 8.8 High CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens 6.8 Medium CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High
Track this CVE