Description

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-21T07:16:54.560Z",
  "pubdate": "2026-09-21T07:16:54.560Z",
  "executiveSummary": "A session management vulnerability exists in Keycloak that allows users to bypass mandatory multi-factor authentication (MFA) requirements.\nThe flaw stems from improper state validation within the authentication flow when client policies enforce stricter security measures, such as mandatory 2FA setup.\nBy manipulating the authentication session via a specific session restart link, an attacker can clear internal security markers responsible for tracking progress through the required authentication steps.\nThis vulnerability allows an attacker to authenticate using only primary credentials, effectively circumventing administrative security policies.\nThe impact includes unauthorized access to resources and accounts that should be protected by MFA, undermining the integrity of identity verification processes.\nExploitation requires the attacker to have valid primary credentials and interaction with the authentication process during the login phase.\nThe vulnerability affects Keycloak deployments where specific client policies for enforced MFA are configured.",
  "technicalDetails": "The vulnerability resides within the Keycloak authentication session management logic, specifically in how the system tracks progress across multi-step authentication flows.\nWhen an administrator enforces a mandatory 2FA setup policy via Keycloak Client Policies, the authentication session is expected to maintain an internal state marker confirming that the user must transition through the 2FA configuration phase before the session is promoted to a fully authenticated state.\nThe root cause is a failure in the state machine logic that governs the session's 'required actions' markers. When a user is presented with the MFA setup prompt, the authentication service records the pending requirement in the session object.\nAn attacker can exploit this by triggering a session restart through a specific URL while the authentication flow is in a pending state. This action, intended to allow users to reset their progress if they encounter issues, inadvertently instructs the session management layer to purge the 'required actions' markers without re-verifying the policy state.\nThe attack flow follows these steps: 1) The user provides valid primary credentials (username and password). 2) The server evaluates the client policy, identifies that MFA setup is required, and redirects the user to the setup page. 3) The attacker intercepts or manually navigates to the provided session restart URL while at the MFA setup screen. 4) The authentication server resets the session context, clearing the flags that indicate the mandatory 2FA requirement. 5) Upon re-initiating or continuing the authentication process, the system erroneously concludes that all necessary authentication steps have been satisfied, granting the user a valid session token despite skipping the MFA setup.\nThis bypass effectively renders the enforced 2FA policy moot, as the internal logic fails to re-validate the policy requirements after the session reset event. The vulnerability is tied to the internal authentication state machine, making it a critical flaw for environments relying on Keycloak to enforce strict identity assurance."
}