Identity Management Login Flaw in Keycloak Authentication Server

CVE-2026-112208

What is CVE-2026-112208?

A flaw exists in the login flow of Keycloak, an open-source identity and access management solution. This vulnerability occurs when an attacker, belonging to multiple organizations, initiates a login session, then navigates to a registration or password reset process. The system fails to clear a login success flag when the user's session is terminated, allowing the attacker to exploit the stale flag. By using a victim's username, the attacker can bypass authentication mechanisms, gaining unauthorized access to the victim's account and associated applications.

References