CVE-2026-105305 Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement
Attackers with stolen passwords can bypass mandatory multi-factor authentication in Keycloak's Device Authorization Grant flow to access the Admin REST API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-105305?
CVE-2026-105305 is a medium-severity authentication bypass vulnerability in Red Hat Build of Keycloak, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.
Weakness: CWE-287
Which versions are affected by CVE-2026-105305?
How do I fix CVE-2026-105305?
No fix has been published for CVE-2026-105305 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-105305 being exploited?
There is no known exploitation of CVE-2026-105305 in the wild and no public exploit code.
Sources
Also known as GHSA-ggxp-hq23-v84f.