CVE-2026-97176 in Keycloak
Summary
by MITRE • 09/24/2026
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within Keycloak represents a critical failure in the enforcement of authentication levels during session re-evaluation processes. Keycloak serves as an identity and access management solution that relies heavily on accurate assertion of user credentials and security contexts to govern access to protected resources. The core technical flaw lies in how the system handles requests from clients that demand a higher level of authentication for users who already possess an active session established at a lower security tier. Instead of triggering a re-authentication flow or upgrading the existing session's trust level, the application logic erroneously proceeds with issuing tokens based on the pre-existing, weaker credentials. This behavior indicates a fundamental lapse in state validation where the system fails to cross-reference the current request's security requirements against the actual strength of the authenticated user context before generating access artifacts.
From an operational perspective, this logic error creates a significant risk of unauthorized access to sensitive resources that depend on strict identity verification standards. When a client application requests a token with elevated privileges or higher assurance levels, it expects the system to verify that the user has recently provided credentials meeting those specific criteria. By bypassing this check and issuing tokens at the lower security level, Keycloak effectively allows users who have only undergone basic authentication to access resources reserved for highly authenticated individuals. This discrepancy undermines the integrity of role-based or attribute-based access control mechanisms implemented by downstream applications, potentially exposing confidential data or critical functionalities to unauthorized entities who may exploit the gap between perceived and actual user trust levels.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding failures in verifying authentication credentials against current session states. Furthermore, it relates to CWE-613, Insufficient Session Expiration, as the system fails to invalidate or upgrade a session that no longer meets the required security policy for the requested operation. In terms of adversary tactics, this flaw facilitates lateral movement and privilege escalation within an identity infrastructure by allowing attackers who have compromised low-level credentials to access high-value targets without needing to perform additional credential harvesting or brute-force attacks against stronger authentication mechanisms. The attack vector typically involves manipulating client requests to specify higher security levels while maintaining a legacy session, thereby exploiting the trust relationship between the identity provider and relying parties.
Mitigation strategies must focus on ensuring that every token issuance event strictly validates the current authentication strength against the requested requirements. Administrators should verify that their Keycloak instances are updated to versions where this logic error has been corrected by the development team. In environments where immediate patching is not feasible, implementing additional validation layers at the application level can provide compensating controls. Relying parties must independently validate the auth_time and other security-related claims within received tokens rather than relying solely on Keycloak's session state management. Additionally, configuring stricter timeout policies for high-security sessions ensures that stale or low-assurance contexts are periodically refreshed through proper re-authentication flows, thereby reducing the window of opportunity for exploitation based on this specific logic flaw.