CVE-2026-105305— Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement
Quick assessment
Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Keycloak 的 OpenID Connect (OIDC) 实现在设备授权码（Device Authorization Grant）流程中发现了一个缺陷。该组件允许具备有限输入能力的设备获取安全令牌。问题出在该流程未能验证客户端配置所要求的最小认证级别，从而导致攻击者在窃取用户密码后，能够绕过强制的多因素认证（MFA），非法访问 Keycloak 的管理 REST API。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105305
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 | - |
cpe:/a:redhat:red_hat_single_sign_on:7
|
|
II. Public POCs for CVE-2026-105305
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105305
请登录查看更多情报信息。
Other References for CVE-2026-105305 (2)
Same Patch Batch · Red Hat · 2026-10-06 · 16 CVEs total
| CVE-2026-92821 | 6.8 MEDIUM | Sssd: sssd: access control bypass via premature ldap access rule evaluation |
| CVE-2026-104044 | 6.2 MEDIUM | Sssd: sssd: denial of service via crafted passkey kerberos authentication request |
| CVE-2026-104038 | 5.9 MEDIUM | Sssd: sssd: denial of service via missing sid extension in certificate mapping |
| CVE-2026-104036 | 5.8 MEDIUM | Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin |
| CVE-2026-104043 | 5.5 MEDIUM | Sssd: sssd: denial of service via undersized packet parsing in nss responder |
| CVE-2026-104042 | 5.5 MEDIUM | Sssd: sssd: denial of service via out-of-bounds read in pam responder |
| CVE-2026-104041 | 5.5 MEDIUM | Sssd: sssd: denial of service via unbounded negative cache growth |
| CVE-2026-104037 | 5.5 MEDIUM | Sssd: sssd: denial of service via packet length underflow in autofs responder |
| CVE-2026-104035 | 5.5 MEDIUM | Sssd: sssd: denial of service via memory exhaustion in kcm responder |
| CVE-2026-104032 | 5.5 MEDIUM | Sssd: sssd: denial of service via unprivileged autofs cache invalidation |
| CVE-2026-104031 | 5.5 MEDIUM | Sssd: sssd: denial of service via memory exhaustion in autofs responder |
| CVE-2026-104033 | 5.4 MEDIUM | Sssd: sssd: access control bypass via improper ldap shadow expiration check |
| CVE-2026-104039 | 4.7 MEDIUM | Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder |
| CVE-2026-104034 | 4.7 MEDIUM | Sssd: sssd: denial of service via use-after-free in kcm ticket renewal |
| CVE-2026-104040 | 4.4 MEDIUM | Sssd: sssd: information disclosure via odata injection in entra id lookups |
IV. Related Vulnerabilities
Same product: Red Hat Build of Keycloak
-
CVE-2026-105306
Keycloak-services: keycloak-services: token introspection au -
CVE-2026-105302
Keycloak-services: keycloak-services: user session note mapp -
CVE-2026-105301
Keycloak-services: keycloak-services: blind ssrf via x.509 a -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-101333
Keycloak-services: keycloak-services: unbounded metric serie
Same vendor: Red Hat
-
CVE-2026-104044
Sssd: sssd: denial of service via crafted passkey kerberos a -
CVE-2026-104043
Sssd: sssd: denial of service via undersized packet parsing -
CVE-2026-104042
Sssd: sssd: denial of service via out-of-bounds read in pam -
CVE-2026-104041
Sssd: sssd: denial of service via unbounded negative cache g -
CVE-2026-104040
Sssd: sssd: information disclosure via odata injection in en
Same weakness: CWE-287
-
CVE-2026-59358
UAA OAuth Token Endpoint Vulnerability allows user access to -
CVE-2026-105704
SourceCodester Drug Recommendation System Auth Guard imprope -
CVE-2026-105640
Plane: Account Takeover via Unverified OAuth Email Match (Gi -
CVE-2026-105213
ZITADEL before 4.17.1 Authentication Bypass via Login V2 for -
CVE-2026-105212
ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passke
V. Comments for CVE-2026-105305
No comments yet