Keycloak OIDC Device Flow Authentication Bypass

Executive Summary

This vulnerability is in Keycloak's OIDC implementation during the Device Authorization Grant flow. It fails to enforce the minimum authentication level required by client settings. An attacker with a stolen password can bypass multi-factor authentication (MFA) and gain unauthorized access to the Keycloak Admin REST API.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Keycloak logs for unusual Device Authorization Grant flow authentications that bypass MFA. Check for access tokens issued with lower authentication levels than configured client minimums. Review admin API access logs for unauthorized actions.

Useful 0 Not Useful 0

Impact Analysis

If exploited, an attacker could gain access to sensitive administrative functions, such as managing users or modifying configurations, by using a stolen password to bypass MFA. This could lead to unauthorized privilege escalation or data exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection and access control in standards like GDPR and HIPAA. It undermines multi-factor authentication controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the Device Authorization Grant flow in Keycloak if not required. Update to a patched Keycloak version when available. Enforce strict client minimum.acr.value settings and monitor for unauthorized admin API access.

Useful 0 Not Useful 0