Authentication Vulnerability in Keycloak by Red Hat
CVE-2026-94218

3.1LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
21 September 2026

What is CVE-2026-94218?

A vulnerability in Keycloak's authentication session management allows users to bypass enforced security measures, such as mandatory two-factor authentication (2FA) setup. When administrators implement a stronger authentication flow via client policy, a user can access a specific session restart link that clears the necessary security markers. This enables them to log in simply with their password, circumventing the requirement for 2FA, which poses significant security risks.

References

https://access.redhat.com/security/cve/CVE-2026-94218
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2537314
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.