Description

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-24T06:17:04.227Z",
  "pubdate": "2026-09-24T06:17:04.227Z",
  "executiveSummary": "A critical vulnerability exists in the Level of Authentication (LoA) enforcement mechanism within Keycloak. The flaw allows for the bypass of elevated security requirements when a user possesses an existing session at a lower authentication level.\nThis logic error involves improper session re-evaluation during authentication requests. If a client application explicitly mandates a higher security level, Keycloak fails to enforce the re-authentication process and incorrectly issues an identity token reflecting the previous, lower security assurance level.\nThe vulnerability directly impacts the integrity of authentication claims, potentially granting unauthorized access to sensitive resources protected by higher LoA policies. An attacker capable of initiating authentication flows can bypass MFA or step-up authentication requirements, compromising the security posture of the affected identity infrastructure.\nExploitation does not necessarily require the compromise of credentials, but rather the exploitation of the flawed state machine governing session management. The risk is high for enterprise environments utilizing multi-tier access control based on granular security levels.",
  "technicalDetails": "The root cause of this vulnerability lies in the state management and session re-evaluation logic within Keycloak's authentication flow processing. When an OIDC or SAML client requests a specific authentication context class reference (ACR) or LoA, the Keycloak server is responsible for validating the current session against these requirements.\nThe failure occurs during the transition between an existing low-security session and a high-security request. When a user authenticates at a lower level and subsequently interacts with a client requiring a higher security level, the Keycloak authentication engine incorrectly relies on the cached session state rather than forcing a new authentication event or challenge.\nThe attack flow follows these steps: First, the attacker establishes a legitimate session with Keycloak at a base security level. Second, the attacker triggers an authentication request from a client application that specifies a higher LoA, typically through the 'acr_values' parameter in an OpenID Connect request. Third, due to the logic error, the Keycloak server detects the existing session and, instead of evaluating the requirement for a new authentication challenge (such as MFA), the session management component mistakenly validates the identity based on the prior, lower-level context.\nConsequently, the server issues a token containing claims that suggest the higher security level has been satisfied, despite no such elevation having occurred. This misrepresentation allows the attacker to bypass the intended security policy enforcement, effectively gaining access to sensitive downstream resources that rely on these forged security claims.\nThe vulnerable component resides within the core identity/authentication processing logic that handles existing user sessions during requested step-up authentication. This flaw is independent of the underlying authentication provider (e.g., LDAP, Kerberos, or internal database) and is strictly a failure in the Keycloak session state machine to force re-authentication when security contexts mismatch.\nSuccessful exploitation results in unauthorized authorization, as the service provider assumes the user has satisfied the increased security requirements. This leads to a degradation of the entire authentication chain, bypassing controls specifically designed to protect high-value assets."
}