Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by redhat

CVE-2026-94218Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint

Low 3.1

In plain English

A low-severity missing authorization in Red Hat build of Keycloak 26.6.8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.3%top 75.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Keycloak 26.6.8 see references
Red Hat Red Hat build of Keycloak 26.6.8 see references
Red Hat Red Hat build of Keycloak 26.6.8 see references
Red Hat Red Hat Single Sign-On 7 see references

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References