CVE-2026-96446
Received Received - Intake

Keycloak PAR Silent Authentication URI Reuse Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96446
EUVD
EUVD-2026-85221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat keycloak *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Keycloak's Pushed Authorization Request (PAR) implementation. When using silent authentication with prompt=none, the system skips security checks that normally enforce single-use request URIs. This allows attackers to reuse a request URI to obtain multiple authorization codes for an already logged-in user, bypassing security standards like FAPI-2.

Detection Guidance

Detecting this vulnerability requires checking Keycloak's PAR implementation and authentication flows. Monitor logs for repeated use of the same request_uri with prompt=none. Verify if PAR request URIs are properly consumed and deleted after use. Check for multiple authorization codes issued for the same user session without re-authentication.

Impact Analysis

An attacker could exploit this to generate multiple authorization codes for a user without re-authentication. This requires the attacker to have valid client credentials and the user to have an active SSO session. The impact includes potential unauthorized token generation and violation of security guarantees.

Compliance Impact

This vulnerability violates FAPI-2 and RFC 9126 requirements for single-use request URIs, which are critical for secure authentication flows. Non-compliance with these standards could impact adherence to GDPR, HIPAA, and other regulations that mandate strong authentication and authorization controls.

Mitigation Strategies

Disable the silent authentication path using prompt=none in Keycloak's PAR implementation. Ensure PAR request URIs are enforced as single-use by verifying the authorization endpoint processes and deletes them after use. Monitor for unusual authorization code generation patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96446. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart