CVE-2026-96446: Keycloak PAR Auth Bypass Vulnerability

CVE-2026-96446 Overview

CVE-2026-96446 is a business logic flaw in the Pushed Authorization Request (PAR) implementation of Keycloak. The vulnerability occurs when the silent authentication path prompt=none is used during the authorization flow. This path allows Keycloak to skip certain steps when a user is already signed in. As a side effect, the enforcement rule that a pushed request_uri must be consumed only once is bypassed. An attacker can replay a pushed request_uri to obtain multiple authorization codes for an already authenticated user. The behavior violates the single-use requirement defined by the Financial-grade API (FAPI) 2.0 profile.

Critical Impact

An attacker with a valid PAR request_uri can reuse it during silent authentication to mint multiple authorization codes for a logged-in user, breaking FAPI-2 compliance guarantees.

Affected Products

• Red Hat Keycloak (see Red Hat CVE-2026-96446 Advisory)
• Keycloak deployments implementing Pushed Authorization Requests (PAR)
• Downstream identity solutions built on affected Keycloak versions

Discovery Timeline

• 2026-09-23 - CVE CVE-2026-96446 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96446

Vulnerability Analysis

Pushed Authorization Requests (PAR) let a client push authorization parameters to the identity provider before redirecting the user. The server returns a short-lived request_uri that the client references in the subsequent /authorize call. The OAuth 2.0 PAR specification (RFC 9126) requires that a request_uri be treated as single-use to prevent replay and interception attacks. Keycloak enforces this rule during interactive login. However, when the client requests silent authentication with prompt=none, the authorization endpoint short-circuits parts of the flow because an existing session is present. The single-use validation on the pushed request_uri is skipped along the way. The flaw is categorized under CWE-862: Missing Authorization because a required check is not applied on a specific code path.

Root Cause

The root cause is inconsistent enforcement of the PAR single-use invariant across authentication paths. The interactive login path invalidates the request_uri after consumption, while the prompt=none silent path does not. This asymmetry allows the same pushed request to be replayed as long as the user session remains valid.

Attack Vector

Exploitation requires that the attacker already hold a valid pushed request_uri for a target client and that the victim have an active Keycloak session. The attacker issues repeated authorization requests using prompt=none and the same request_uri, receiving a fresh authorization code each time. Each code can be exchanged for tokens, expanding the impact of a single leaked request reference and breaking replay protections mandated by FAPI-2.

No public proof-of-concept is available. See the Red Hat Bug Report #2539284 for vendor technical details.

Detection Methods for CVE-2026-96446

Indicators of Compromise

• • Multiple successful /authorize responses tied to the same PAR request_uri within its validity window.
• • Repeated authorization code issuance for the same user and client in a short interval, all using prompt=none.
• • Token exchanges (/token) referencing distinct authorization codes that all trace back to a single pushed request.

Detection Strategies

• • Correlate Keycloak event logs (CODE_TO_TOKEN, LOGIN) by request_uri identifier to surface reuse.
• • Alert when the same request_uri value appears in more than one authorization event.
• • Baseline the ratio of PAR pushes to authorization code issuances per client; investigate clients where issuances exceed pushes.

Monitoring Recommendations

• • Forward Keycloak admin and user event streams to a centralized analytics platform with retention sufficient for replay analysis.
• • Monitor identity provider logs for spikes in prompt=none requests originating from a single client or IP.
• • Track token issuance patterns per session and flag sessions generating unusually high numbers of access tokens.

How to Mitigate CVE-2026-96446

Immediate Actions Required

• • Apply the fixed Keycloak release referenced in the Red Hat CVE-2026-96446 Advisory as soon as it is available for your distribution.
• • Inventory clients that use PAR and identify any that rely on prompt=none silent authentication.
• • Rotate any client secrets or credentials that may have been exposed through leaked request_uri values.

Patch Information

Red Hat tracks remediation under the Red Hat CVE-2026-96446 Advisory and Red Hat Bug Report #2539284. Consult these references for the exact fixed versions and errata applicable to your Keycloak or Red Hat Build of Keycloak deployment.

Workarounds

• • Restrict or disable prompt=none for clients configured to use PAR until the patch is deployed.
• • Shorten the request_uri lifetime (parRequestUriLifespan) to minimize the replay window.
• • Enforce sender-constrained tokens (mTLS or DPoP) so that stolen authorization artifacts cannot be redeemed by an attacker.
• • Require step-up authentication for high-value clients so silent flows cannot silently mint additional codes.

# Configuration example: reduce PAR request_uri lifespan on an affected realm
kcadm.sh update realms/<realm> \
  -s 'attributes."parRequestUriLifespan"=60'

# Optional: disable prompt=none behavior for a sensitive client by requiring login
kcadm.sh update clients/<client-uuid> -r <realm> \
  -s 'attributes."require.pushed.authorization.requests"=true' \
  -s 'attributes."client.session.max.lifespan"=300'