Keycloak: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Summary

Product

Vulnerabilities 1

• Medium 5.4
  CVE-2026-105305

  Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

  A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the min…

  Red Hat Red Hat Single Sign-On 7 Red Hat build of Keycloak 26.6 Red Hat build of Keycloak 26.6.8
  Oct 6, 2026

Revision history

1. 2026-11-08 #3

   Neue Updates von Red Hat aufgenommen

2. 2026-11-05 #2

   Neue Updates aufgenommen

3. 2026-10-05 #1

   Initiale Fassung

References

• Red Hat Bugtracker 2545801 vom 2026-10-05
  https://bugzilla.redhat.com/show_bug.cgi?id=2545801
• NIST Vulnerability Database vom 2026-10-05
  https://nvd.nist.gov/vuln/detail/cve-2026-105305
• RedHat Customer Portal vom 2026-10-05
  https://access.redhat.com/security/cve/cve-2026-105305
• Keycloak 26.8.2 Release Notes vom 2026-11-05
  https://www.keycloak.org/2026/11/keycloak-2682-released
• Red Hat Security Advisory RHSA-2026:95761 vom 2026-11-06
  https://access.redhat.com/errata/RHSA-2026:95761
• Red Hat Security Advisory RHSA-2026:95762 vom 2026-11-06
  https://access.redhat.com/errata/RHSA-2026:95762