Authentication Flaw in Keycloak Identity Management Solution

CVE-2026-97176

What is CVE-2026-97176?

A flaw exists in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. This vulnerability arises when a client demands a higher security level for a user who already has an active session established at a lower security level. Due to incorrect logic in handling session re-evaluations, Keycloak might mistakenly issue a token at the lower security level, leading to potential unauthorized access to sensitive resources protected by these security claims.

References