Authentication Bypass in Keycloak Due to Session Re-Evaluation Flaw

Executive Summary

CVE-2026-97176 is a flaw in Keycloak's Level of Authentication enforcement mechanism. When a client requests a higher security level for a user with an existing lower-level session, Keycloak may incorrectly issue a token at the lower level instead of enforcing the required higher level. This happens due to a logic error in session re-evaluation, potentially allowing unauthorized access to sensitive resources.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak logs for failed authentication attempts or unexpected token issuances. Check for sessions where the authentication context class reference (acr) does not match the required level. Look for ConditionalLoaAuthenticator component failures or missing top-flow-success callbacks in logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid low-level session could exploit this to obtain tokens for clients requiring higher authentication levels without providing additional factors. This bypasses authentication level requirements, potentially granting unauthorized access to sensitive resources that rely on these security claims.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by allowing unauthorized access to sensitive resources due to improper enforcement of authentication levels. If an attacker exploits the flaw, they may bypass required security controls, potentially violating data protection requirements for access control and session management.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Keycloak patches if available. Temporarily disable the ConditionalLoaAuthenticator component or modify browser flow configurations to enforce step-up authentication. Monitor for unauthorized access attempts and restrict sessions requiring higher authentication levels.

Useful 0 Not Useful 0