Keycloak CVE-2026-94218

Requires a Keycloak deployment where an administrator has enforced a stronger authentication flow - specifically mandatory 2FA setup - via a client policy; the flaw does not exist without this configuration. The actor must possess valid first-factor (password) credentials for a real account (PR:L), and must know/visit the specific session-restart web link during the login process. Limiting factors: it is a self-bypass by a legitimate user rather than a remote compromise, impact is integrity-only (weakened authentication posture, no data read or system impact), and it is inapplicable to any deployment not using client-policy-enforced step-up/2FA enrollment.

This is a low-severity, config-gated security-control bypass, not a remote takeover. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) yields a 3.1 score with integrity-only impact and no confidentiality or availability effect, and the 'attacker' is essentially a legitimate low-privilege user (PR:L - they already hold valid password credentials) circumventing their OWN mandated 2FA setup. AC:H is justified because the flaw only manifests in deployments where an administrator has actively enforced a stronger authentication flow (e.g. mandatory 2FA setup) through a client policy - it is not present in default configs. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' All impact signals point the same direction: this is a genuine defense-in-depth weakness (a user can log in with password only, defeating an org's 2FA mandate) rather than a widely-weaponizable vulnerability. Priority is low-to-moderate for organizations that specifically rely on Keycloak client policies to force 2FA enrollment; near-zero for others. Note the CWE-862 (missing authorization) classification versus the 'Authentication Bypass' tag - the effect is best described as an authentication-flow/2FA-enforcement bypass; both framings are defensible here.

In a Keycloak deployment where an admin has used a client policy to force mandatory 2FA setup, a user who wishes to avoid enrolling begins the normal login, then manually navigates to a specific session-restart URL mid-flow. This clears the internal markers tracking the required security steps, letting them complete login with only their password and never enroll in 2FA. No public exploit code is identified; the technique requires only knowledge of the restart link and valid first-factor credentials.