EUVD-2026-85792
GHSA-5jw9-cc9v-8h8r
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Remote token endpoint (AV:N) but needs a pre-existing lower-level session (PR:L) and depends on a re-evaluation timing/logic condition (AC:H); partial confidentiality/integrity from claim downgrade, no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.
AnalysisAI
Keycloak's Level of Authentication (LoA) step-up enforcement can fail open: when a relying client requires a higher authentication level for a user who already holds an active session at a lower level, a logic error in session re-evaluation causes Keycloak to issue a token carrying the lower acr/LoA claim instead of forcing the required step-up authentication. The impact is a bounded assurance downgrade rather than unauthenticated access - the attacker must already be authenticated (CVSS PR:L) - but it may grant access to sensitive resources whose authorization decisions trust those claims, with low confidentiality and integrity impact and no availability impact (CVSS:3.1 4.2, AV:N/AC:H/UI:N/S:U/C:L/I:L/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an existing active Keycloak user session established at a LOWER Level of Authentication; (2) a relying client explicitly configured to require a HIGHER security level / step-up authentication (elevated acr/LoA claim); and (3) triggering the flawed session re-evaluation path so a new token is issued reusing the lower level. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite touching authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is specified in the available intelligence, so the first action is to monitor https://access.redhat.com/security/cve/CVE-2026-97176 and https://bugzilla.redhat.com/show_bug.cgi?id=2539964 and apply the fixed Red Hat Build of Keycloak / RH-SSO 7 errata as soon as they are published - the CVE is currently tracked as no vendor-released patch identified at time of analysis, which is an absence of data rather than confirmation that none will ship. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today