CVE-2026-94218: Keycloak Authentication Bypass Vulnerability

CVE-2026-94218 Overview

CVE-2026-94218 is an authorization flaw in the authentication session management of Keycloak, an open-source identity and access management solution. Administrators can enforce stronger authentication flows through client policies, such as mandatory two-factor authentication (2FA) setup. A user can bypass this requirement by manually visiting a specific session restart web link during login. Visiting that link clears the internal markers that track the required security steps. The user then completes login with only a password and gains access without completing the mandated 2FA setup. The weakness is classified under CWE-862: Missing Authorization.

Critical Impact
Authenticated users can bypass administrator-enforced 2FA setup policies, weakening account protection for applications relying on Keycloak client policies.

Affected Products

Red Hat Keycloak (see Red Hat CVE-2026-94218 for version details)
Red Hat build of Keycloak
Applications relying on Keycloak client policies for mandatory 2FA enrollment

Discovery Timeline

2026-09-21 - CVE-2026-94218 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94218

Vulnerability Analysis

Keycloak uses authentication sessions to track a user's progress through a configured authentication flow. Client policies can require additional steps, such as enrolling an OTP or WebAuthn credential, before the login completes. The server records these required actions and executor state inside the authentication session.

The flaw arises because a session restart endpoint reachable during the login process resets that state without re-evaluating the client policy. When a user navigates to the restart link mid-flow, the internal markers that enforce mandatory 2FA setup are cleared. The subsequent authentication continues using only the primary credential, and the enforced step never executes. The result is an authorization gap between the policy engine and the session state machine.

Root Cause

The root cause is missing authorization enforcement on the session restart path. The restart operation trusts the caller and rebuilds the authentication session without re-applying client policy executors that mandate additional factors. Because the required-action markers live in the session rather than in a persistent policy check, resetting the session effectively cancels the requirement.

Attack Vector

Exploitation requires an authenticated user who is subject to a client policy enforcing 2FA setup. The user initiates a login, then manually navigates to the session restart URL exposed by the Keycloak login flow. After the restart, the user submits the password and completes login without configuring the second factor. No elevated privileges, network position, or victim interaction is required beyond knowledge of the restart endpoint.

No verified public proof-of-concept code is available. For technical details, review the Red Hat Bug Report #2537314 and the Red Hat CVE-2026-94218 advisory.

Detection Methods for CVE-2026-94218

Indicators of Compromise

Successful logins by accounts subject to a mandatory 2FA client policy that lack a registered OTP or WebAuthn credential.
Authentication session events showing a RESTART_AUTHENTICATION or equivalent restart action followed immediately by a successful primary-credential login.
Client policy audit entries indicating required actions were expected but never executed for a completed login.

Detection Strategies

Correlate Keycloak event logs (LOGIN, RESTART_AUTHENTICATION, UPDATE_TOTP) per session ID to identify logins that completed without the mandated credential enrollment.
Query the user store for accounts covered by a 2FA client policy and cross-reference against users lacking configured second-factor credentials.
Alert on repeated visits to the authentication session restart endpoint from the same session or IP during an active login flow.

Monitoring Recommendations

Forward Keycloak admin and user event logs to a centralized SIEM or data lake for retention and correlation.
Enable full event logging (spi-events-listener-jboss-logging-success-level=info) so restart and required-action events are captured.
Build dashboards that track the ratio of enforced-policy logins to completed 2FA enrollments to surface policy drift.

How to Mitigate CVE-2026-94218

Immediate Actions Required

Apply the Keycloak update referenced in the Red Hat CVE-2026-94218 advisory as soon as it is available for your distribution.
Audit all users governed by mandatory 2FA client policies and force credential enrollment for accounts missing a second factor.
Invalidate active sessions for affected users so login flows are re-evaluated under the patched behavior.

Patch Information

Red Hat tracks remediation for this issue under Red Hat CVE-2026-94218 and Red Hat Bug Report #2537314. Upgrade to the fixed Keycloak or Red Hat build of Keycloak release identified in those advisories. Verify the deployed version after patching and re-test the 2FA enforcement flow.

Workarounds

Configure 2FA as a required action at the realm level (Authentication > Required Actions > Configure OTP) so enrollment is enforced independently of client policy state.
Restrict access to the authentication session restart endpoint via a reverse proxy or web application firewall rule during the login flow.
Pre-provision second-factor credentials for privileged accounts to eliminate reliance on first-login enrollment.

bash

# Configuration example: enforce OTP as a realm-level required action via kcadm
kcadm.sh update authentication/required-actions/CONFIGURE_TOTP \
  -r <realm> \
  -s enabled=true \
  -s defaultAction=true