Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-97176— Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator

Quick assessment

Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在身份和访问管理解决方案 Keycloak 的认证级别强制机制中发现了一个缺陷。当客户端要求已处于较低安全级别会话中的用户提升安全级别时，问题就会出现。由于会话重新评估处理逻辑存在错误，Keycloak 可能会错误地颁发较低安全级别的令牌，而非强制实施所需的高安全级别，从而可能导致未经授权访问依赖于这些安全声明的敏感资源。

CVSS 4.2 · Medium EPSS 0.17% · P5
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-97176

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat Single Sign-On 7 - cpe:/a:redhat:red_hat_single_sign_on:7

II. Public POCs for CVE-2026-97176

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-97176

请登录查看更多情报信息。

Other References for CVE-2026-97176 (2)

Same Patch Batch · Red Hat · 2026-09-24 · 8 CVEs total

CVE-2026-90959 8.1 HIGH Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enabl
CVE-2026-95521 7.8 HIGH Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when i
CVE-2026-95519 7.8 HIGH Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify m
CVE-2026-97185 7.8 HIGH Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file
CVE-2026-94416 6.8 MEDIUM Aap-gateway: aap-gateway: authorization bypass via workload identity token forgery
CVE-2026-97177 6.6 MEDIUM Keycloak-services: keycloak-services: generic user update bypasses denied reset-password p
CVE-2026-97311 4.3 MEDIUM Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups

IV. Related Vulnerabilities

Same product: Red Hat Build of Keycloak
Same vendor: Red Hat
Same weakness: CWE-862

V. Comments for CVE-2026-97176

No comments yet

Leave a comment