What’s Vulnerable › Vulnerabilities

CVE-2026-105305: Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-06
• Weakness: CWE-287

Description

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.

Affected products

• Red Hat build of Keycloak 26.4: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-105305
• https://bugzilla.redhat.com/show_bug.cgi?id=2545801

Get alerted when CVE-2026-105305 or the next vulnerability affects your stack