Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.1
CVE-2026-94218: Keycloak can skip forced 2FA setup
CVE-2026-94218 · published 28 days ago
Summary
In Red Hat Build of Keycloak and Red Hat Single Sign‑On 7, an administrator can require users to set up two‑factor authentication, but a user can avoid this by clicking a special session‑restart link during login. The link clears the system’s record of the required step, letting the user sign in with only a password. Apply the latest security update from Red Hat and verify that the forced 2FA policy is correctly enforced.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat build of keycloak | All versions |
| red hat | red hat single sign-on 7 | All versions |
Original advisory text
Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint
A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta