CVE-2026-97176: Keycloak Authentication Bypass Vulnerability

CVE-2026-97176 Overview

CVE-2026-97176 is a missing authorization flaw [CWE-862] in the Level of Authentication (LoA) enforcement mechanism of Keycloak, an open-source identity and access management solution. The vulnerability occurs when a client requires a higher security level for a user who already holds an active session at a lower level. Due to a logic error in session re-evaluation, Keycloak may issue a token at the lower security level instead of enforcing the required higher level. Applications that rely on LoA claims to gate access to sensitive resources may grant unauthorized access as a result.

Critical Impact
Authenticated users with low-assurance sessions can obtain tokens that bypass step-up authentication requirements for sensitive application resources.

Affected Products

Red Hat build of Keycloak
Upstream Keycloak identity and access management server
Applications relying on Keycloak Authentication Context Class Reference (ACR) claims for step-up authentication

Discovery Timeline

2026-09-24 - CVE CVE-2026-97176 published to NVD
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-97176

Vulnerability Analysis

Keycloak supports step-up authentication through the Level of Authentication model, which maps authentication strength to ACR values returned in issued tokens. Clients request a specific LoA when a resource demands stronger assurance than a user's current session provides. The expected behavior is for Keycloak to prompt the user for additional authentication factors before issuing a token that carries the elevated ACR claim.

In vulnerable versions, the session re-evaluation path does not consistently enforce this requirement. When a user with an active low-level session accesses a client that mandates a higher level, Keycloak can issue a token reflecting the lower level while still completing the authorization flow. Downstream applications that trust the ACR or acr claim as proof of step-up authentication treat the response as valid, granting access to protected resources without the required factor.

Root Cause

The root cause is a logic error in how Keycloak evaluates existing sessions against client LoA requirements. The authorization code does not re-check the required level before token issuance, resulting in a missing authorization condition [CWE-862] rather than a bypass of the authentication mechanism itself.

Attack Vector

Exploitation requires an authenticated user with an active low-assurance session and knowledge of a client configured to require a higher LoA. The attack is network-based and does not require user interaction beyond the normal authentication flow. Attack complexity is high because the attacker must craft or trigger a specific session re-evaluation sequence against a client that enforces step-up authentication.

No verified public proof-of-concept code is available. Refer to the Red Hat CVE-2026-97176 Advisory and Red Hat Bug Report #2539964 for vendor technical details.

Detection Methods for CVE-2026-97176

Indicators of Compromise

Tokens issued for clients configured with high LoA requirements that contain lower-than-expected acr claim values.
Access events to protected resources without a preceding step-up authentication prompt in Keycloak event logs.
Unexpected CODE_TO_TOKEN or TOKEN_EXCHANGE events for sensitive clients from sessions originally authenticated at a lower assurance level.

Detection Strategies

Audit Keycloak event logs for authentication flows targeting step-up clients and correlate the issued ACR value against the client's configured required level.
Instrument relying applications to log and alert when a token's acr claim falls below the resource's required level.
Review access patterns across identity-federated applications to detect sessions reaching high-sensitivity resources without a matching step-up event.

Monitoring Recommendations

Enable Keycloak's admin and user event logging and forward events to a centralized SIEM for correlation.
Monitor the ratio of step-up authentication prompts to high-LoA token issuances; a declining ratio can indicate exploitation.
Track administrative changes to authentication flows, ACR-to-LoA mappings, and client authentication requirements.

How to Mitigate CVE-2026-97176

Immediate Actions Required

Apply the Keycloak updates referenced in the Red Hat CVE-2026-97176 Advisory as soon as they are available for your distribution.
Inventory all Keycloak clients that rely on LoA or ACR claims for step-up authentication and prioritize them for patching.
Rotate or revoke active sessions and refresh tokens for clients that enforce step-up authentication to force re-authentication under patched logic.

Patch Information

Red Hat has published tracking for this vulnerability under the Red Hat CVE-2026-97176 Advisory and Red Hat Bug Report #2539964. Consult the advisory for the fixed component versions applicable to your Keycloak or Red Hat build of Keycloak deployment and schedule the upgrade through your standard change-management process.

Workarounds

Reduce the maximum session lifetime for realms serving step-up-protected clients to limit the window in which stale low-level sessions can be reused.
Enforce authorization checks in relying applications that independently verify the acr claim against the resource's required level before granting access.
Where feasible, require users to log out and re-authenticate before accessing high-assurance clients until a patched version is deployed.

bash

# Example: validate the acr claim server-side in a relying application
# Pseudocode - adapt to your framework and token library
REQUIRED_ACR="2"
TOKEN_ACR=$(jq -r '.acr' <<< "$DECODED_JWT_PAYLOAD")
if [ "$TOKEN_ACR" -lt "$REQUIRED_ACR" ]; then
  echo "Rejecting token: acr=$TOKEN_ACR below required $REQUIRED_ACR"
  exit 1
fi