EUVD-2026-93019
GHSA-ggxp-hq23-v84f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable token flow (AV:N/AC:L) exploitable only with stolen valid credentials (PR:L), no user interaction; impact limited to the compromised account's scope so C:L/I:L and A:N.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.
AnalysisAI
Authentication bypass in Keycloak's OIDC Device Authorization Grant flow allows an attacker who already possesses a valid user password to evade a client's configured minimum authentication level, including mandatory multi-factor authentication, and gain unauthorized access to the Keycloak Admin REST API, according to Red Hat. The flaw is a missing enforcement check (CWE-287) affecting Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments where the device authorization flow is enabled for a client that requires elevated authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions: (1) the attacker must already possess a valid user's password (PR:L - this is a precondition, not an unauthenticated flaw); (2) the targeted OIDC client/realm must be configured to require a minimum authentication level such as mandatory multi-factor authentication, since the bug is the failure to enforce that configured level; and (3) the OIDC Device Authorization Grant flow must be enabled/available for the client. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity authentication bypass (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) in Keycloak's OIDC Device Authorization Grant flow, reported by Red Hat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No exact vendor-released fix version is provided in the available data; monitor the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2026-105305 and Bugzilla 2545801 for patched packages for Red Hat Build of Keycloak and Red Hat Single Sign-On 7, and apply the vendor update when it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today