CVE-2026-94218

Executive Summary

CVE-2026-94218 is an improper authorization flaw (CWE-862, "Missing Authorization") in the authentication session management of Keycloak, an identity and access management (IAM) solution. When an administrator enforces a stronger authentication flow — such as mandatory two-factor authentication (2FA) enrollment — through a client policy, an authenticated user can bypass that requirement by manually visiting a specific session restart web link during the login process, which clears the internal markers tracking the required security steps. The practical impact is a policy-enforcement bypass: the affected user authenticates with only a password and reaches the protected resource without completing mandated 2FA setup, weakening the identity assurance the administrator intended to guarantee.

Technical Analysis

The vulnerability resides in Keycloak's authentication session management and its handling of required authentication flow steps. Keycloak models a login as an ordered execution of authenticators, with session-level state (execution status and "required action" markers) carried in the authentication session. When an administrator attaches an authentication flow to a client via a client policy — for example, one that mandates 2FA configuration — the flow is expected to be invariant: the user cannot obtain a token or session until the mandated authenticators have executed successfully.

CVE-2026-94218 breaks that invariant. The NVD description states that a user can bypass the enforced requirement by manually visiting a specific session restart web link during the login process. Restarting an authentication session is a legitimate operation — it re-initializes the authentication session, which by design clears the internal markers that record which required security steps have been satisfied and which remain outstanding. The flaw is that this restart is reachable from a context where the client policy's mandated steps should still be enforced after re-initialization. Because the markers tracking the required security steps are cleared on restart and the policy requirement is not re-imposed on the restarted session, the user is returned to a state in which only password authentication is required. The user then logs in with a password alone and gains access without completing the mandated 2FA setup.

The root cause class is CWE-862: the restart operation is not subject to an authorization check confirming that the current client policy still mandates unfinished authenticators, and the enforcement state is maintained only transiently in session markers rather than being re-derived from policy on restart. Consequently, a state-reset operation is treated as a trusted re-entry point, allowing policy state to be discarded rather than merely reset.

Important limitations on what is known: the supplied data does not identify the exact web link, its path, or its parameters; does not identify the specific classes, methods, or configuration keys involved; and does not enumerate affected Keycloak versions or a fixed version. All statements above are derived strictly from the described mechanism — session restart clearing internal required-step markers under an enforced client policy. Readers should treat the specific link identifier and code-level location as unconfirmed pending a vendor advisory.

Notably, the CVSS v3.1 vector carries AC:H (High attack complexity) with PR:L (Low privileges required) and UI:N (No user interaction). The High complexity rating is consistent with a bypass that requires the attacker to possess valid low-privileged credentials and to know and manually invoke a specific session-management link at exactly the right moment in the login process — it is not a blind, fully automated exploit. The Integrity impact is Low (I:L); Confidentiality and Availability impacts are None. This reflects a bypass that grants the attacker no additional data access or privilege beyond what the targeted low-privileged account already had, but does defeat an administrative control (the enforced 2FA requirement), producing a limited integrity/assurance violation.

Because the manipulation is performed through a normal web link traversal during an already-established (in-progress) authentication session, the activity is largely indistinguishable from legitimate navigation to well-known endpoints unless the restart event is logged and correlated against the enforcer's client policy.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. No specific function names, URL paths, or parameter names are asserted, because the supplied data does not contain them.

1. Reconnaissance / target identification. The attacker identifies a Keycloak deployment (sign-in pages, standard IAM hostnames, and Keycloak-branded login interfaces are readily discoverable) in which an administrator has attached an authentication flow to a client policy that mandates a stronger flow such as 2FA setup. The attacker must already hold valid low-privileged credentials for an account subject to that policy (PR:L). The attacker's objective is to determine that the account has not yet satisfied the mandated step — typically because the account is in a "must configure 2FA" state after first password authentication.

2. Triggering the flaw class. The attacker begins a normal login and supplies the account password. At the point where Keycloak presents the mandated setup step (the enrollment/required-action screen for the enforced 2FA flow), the attacker does not complete it. Instead, the attacker manually navigates to the session restart web link referenced in the advisory rather than submitting the enrollment form.

3. Execution mechanism (class-level). The restart link causes the authentication session to be re-initialized. Re-initialization clears the internal markers that track the required security steps for the session. Because enforcement of the client policy's mandated step is not re-applied to the restarted session, the session no longer carries the "2FA setup outstanding" requirement. The attacker then completes login with only the password, reaching the protected application as an authenticated session that never satisfied the administrator's mandated flow.

4. Post-exploitation impact. The attacker gains access to the client/application with a password-only session, defeating the administrative 2FA-enforcement control for that account. Per the CVSS vector, integrity impact is Low and confidentiality/availability impacts are None — the bypass does not by itself grant broader privileges or expose additional data beyond the targeted account's existing entitlements. The primary loss is assurance: the organization can no longer rely on its enforced 2FA policy as evidence that sessions on that client were strongly authenticated. This is most consequential where the enforced flow was the sole compensating control (for example, for accounts with sensitive but bounded access, or where password-only sessions are otherwise disallowed). An attacker with a stolen or guessed password for an account that the enterprise believed was protected by mandatory 2FA enrollment obtains access that policy was designed to prevent.

Impact Assessment

CVE-2026-94218 is a security-policy enforcement bypass in an IAM component, with an assigned CVSS v3.1 base score of 3.1 (Low) and vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. Subscore drivers:

• Attack Vector: Network (AV:N) — the session restart link is reachable over the network as part of the standard web login flow.
• Attack Complexity: High (AC:H) — exploitation depends on precise interaction with an in-progress authentication session and knowledge of the specific restart link; it is not a general, blind exploit.
• Privileges Required: Low (PR:L) — the attacker needs valid low-privileged credentials for an account subject to the enforced policy.
• User Interaction: None (UI:N) — no separate victim action beyond the attacker's own session is required.
• Scope: Unchanged (S:U) — the bypass affects the same security authority that enforces the policy.
• Confidentiality: None (C:N), Availability: None (A:N).
• Integrity: Low (I:L) — the administrative control requiring 2FA setup is defeated; this is an assurance/integrity violation rather than a data confidentiality or availability breach.

Business impact centers on loss of identity-assurance guarantees. Organizations that deploy Keycloak as the central identity provider and depend on client policies to enforce 2FA enrollment may find that some users can obtain password-only sessions on those clients, invalidating compliance mappings (e.g., access-control and strong-authentication requirements) that assume enforcement is absolute. Affected systems are Keycloak deployments using client policies that mandate a stronger authentication flow (such as 2FA setup). Blast radius is bounded by the fact that exploitation requires valid credentials for a policy-subject account and cannot escalate confidentiality or availability beyond that account's existing access; it is nevertheless a broad, systemic weakness affecting all clients whose enforcement relies on the affected mechanism. Compounding factors: no published PoC reduces immediate exploitation pressure, but the mechanism is simple (a link visit), the bug class (state-reset clearing enforcement markers) is the kind that is often independently rediscovered, and no patch or affected-version data is published, meaning defenders cannot cleanly scope exposure by version. The absence of a CISA KEV listing and the lack of an EPSS score mean there is no current evidence of mass exploitation or elevated probabilistic risk signal — but EPSS is unscored, not low, and should be re-evaluated once scoring is available.

Detection Guidance

Detection should focus on (a) authentication-session restart events occurring during an enforced authentication flow, and (b) successful password-only logins for accounts/clients where a stronger flow was mandated. Because Keycloak emits detailed authentication and admin event logs, these are the primary telemetry sources. The rules below are illustrative and must be tuned to your event format, realm names, client IDs, and logging configuration.

Sigma Rule

title: Keycloak Authentication Session Restart During Enforced 2FA Flow (CVE-2026-94218)
id: 3f4b8d2e-1c77-4a90-9b6e-2f0c9a51d7e4
status: experimental
description: Detects a Kerberos-style state reset attempt, specifically a Keycloak authentication session restart during an in-progress enforced authentication flow (e.g. mandatory 2FA setup), which may indicate bypass of the client policy per CVE-2026-94218.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94218
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1548
  - attack.t1556
logsource:
  product: keycloak
  service: authentication
detection:
  selection_event:
    event_type:
      - 'AUTHENTICATION_SESSION_RESTART'
      - 'RESTART_AUTHENTICATION'
      - 'LOGIN_ERROR'
  selection_markers:
    message|contains:
      - 'restart'
      - 'authentication session'
  filter_admin:
    actor|startswith: 'service-account'
  condition: selection_event or (selection_markers and not filter_admin)
falsepositives:
  - Legitimate user-initiated login retries after mistyped passwords
  - Session timeouts followed by re-authentication
level: medium

YARA Rule

rule CVE_2026_94218_Keycloak_SessionRestart_Markers
{
    meta:
        description = "Detects Keycloak request/URL patterns consistent with authentication session restart during an enforced flow (CVE-2026-94218). Heuristic; tune to deployment."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94218"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $kw_restart = "restart" ascii nocase
        $kw_auth    = "authentication" ascii nocase
        $kw_session = "session" ascii nocase
        $kw_realm   = "/realms/" ascii nocase
        $kw_flow    = "authentication flow" ascii nocase

    condition:
        filesize < 5MB and
        (
            (2 of ($kw_restart, $kw_session, $kw_auth)) or
            ($kw_realm and $kw_restart)
        )
}

Note: this is a heuristic content rule for examining web-affecting log/HTTP artifacts; the vulnerability does not manifest as a file on disk, so network- and log-based detection is the primary control.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94218 Keycloak authentication session restart during enforced flow (suspected bypass)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"restart"; nocase; http.uri; content:"session"; nocase; reference:cve,2026-94218; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94218; classtype:attempted-user; sid:202694218; rev:1;)

alert http any any -> any any (msg:"CVE-2026-94218 Keycloak auth flow restart endpoint access"; flow:established,to_server; http.uri; content:"/realms/"; nocase; http.uri; content:"restart"; nocase; reference:cve,2026-94218; classtype:attempted-user; sid:202694219; rev:1;)

These signatures intentionally key on the co-occurrence of "restart" and "session"/"/realms/" in the request URI, since the exact restart link is not published. Expect false positives from ordinary session-management endpoints; validate against your Keycloak URL layout and narrow the URI match before production use.

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "failure" ]
  [ authentication where event.action in ("authentication-session-restart", "restart-authentication",
        "login") and
      (url.path : "*restart*" or url.path : "*session*") and
      event.outcome == "success" ]

Broader singleton variant for environments not modeling authentication phases:

authentication where event.category == "authentication" and
  url.path : "*restart*" and
  not user.name : "service-account-*"

Splunk SPL Query

index=keycloak (sourcetype=keycloak OR sourcetype=keycloak:auth)
(event_type="AUTHENTICATION_SESSION_RESTART" OR event_type="RESTART_AUTHENTICATION"
 OR uri_path="*restart*" OR message="*authentication session*")
NOT user="service-account-*"
| eval suspicious=if(match(lower(uri_path),"(restart|session)") AND match(lower(event_type),"restart"),1,0)
| stats count min(_time) as first_seen max(_time) as last_seen values(clientId) as clients values(realmName) as realms by user ip
| where count >= 2
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Correlation query — password-only success for a client that mandates a stronger flow:

index=keycloak sourcetype=keycloak:auth event_type="LOGIN" outcome="success" auth_method="password"
| join type=left max=1 user [ search index=keycloak sourcetype=keycloak auth_method="*otp*" OR auth_method="*webauthn*" | stats count by user ]
| where isnull(count)

Wazuh OSSEC Rule

<group name="keycloak,cve-2026-94218,">
  <rule id="100942" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">AUTHENTICATION_SESSION_RESTART</field>
    <description>CVE-2026-94218: Keycloak authentication session restart detected during login flow (possible 2FA policy bypass).</description>
    <mitre>
      <id>T1548</id>
      <id>T1556</id>
    </mitre>
  </rule>

  <rule id="100943" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">LOGIN</field>
    <field name="outcome">SUCCESS</field>
    <field name="auth_method">password</field>
    <description>CVE-2026-94218: Successful password-only login for account - verify if a stronger flow was mandated for this client.</description>
  </rule>
</group>

Tune field names (event_type, outcome, auth_method) to match your Keycloak JSON event schema; Keycloak's audit/event listeners must be enabled and forwarded to Wazuh for these rules to fire.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; no vendor fix identified in the supplied data, no workarounds published, and no affected/fixed version ranges enumerated. Consequently, version-based scoping and patch-based remediation are not possible from the intelligence available and must be confirmed directly with the vendor.

1. Immediate mitigations (compensating controls, since no patch exists):

• Monitor Keycloak advisories and the CVE record directly for an affected-version list and a fixed release; treat absence of version data as unresolved, not as "not affected."
• Enable and centralize Keycloak authentication and admin event logging (event listeners forwarding to your SIEM) so session-restart and password-only logins can be detected and reviewed; the detection rules above depend on this telemetry.
• Detect and alert on authentication session restarts that occur while a stronger flow (e.g., 2FA setup) is mandated for the client, and on successful password-only logins for accounts/clients that require a stronger flow.
• Where operationally feasible, treat accounts subject to a mandated 2FA setup policy as high-risk until they complete enrollment, and consider temporarily restricting such accounts' access to sensitive clients until the requirement is satisfied.
• Enforce least privilege so that the impact of any password-only session is bounded by the account's existing entitlements (per the CVSS vector, the bypass grants no additional privilege).
• Consider requiring 2FA enrollment out-of-band (e.g., a controlled provisioning process) for high-value accounts so that an interactive bypass cannot skip it.

2. Patch/upgrade steps:

• No patch is available. Contact the vendor (Keycloak maintainers / your commercial distribution provider) for a fixed version and definitive affected-version range.
• Once a fixed release is published, upgrade all Keycloak nodes — including clusters and any embedded or managed distributions — and re-verify that client policies enforcing stronger flows behave as intended by testing that an in-progress enforced flow cannot be reset to a password-only state.

3. Long-term hardening:

• Ensure authentication-flow enforcement is re-derived from policy on any session state reset, rather than relying solely on transient session markers — validate this behavior against the vendor fix when available.
• Adopt a defense-in-depth identity posture: combine strong-authentication enforcement with conditional-access signals (device posture, network, risk) so that no single control (2FA enrollment) is the sole barrier.
• Continuously validate IAM policy enforcement with red-team exercises that specifically attempt state-reset and flow-manipulation techniques against your authentication flows.
• Maintain a vulnerability-management process that flags IAM/authentication-policy bypasses for immediate triage regardless of nominal CVSS score, given the outsized assurance impact of identity-control failures.

References

• NVD — CVE-2026-94218: https://nvd.nist.gov/vuln/detail/CVE-2026-94218
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1548 — Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
• MITRE ATT&CK T1556 — Modify Authentication Process: https://attack.mitre.org/techniques/T1556/
• Keycloak project security advisories (consult for the authoritative affected/fixed version and vendor workaround; no advisory is identified in the supplied data): https://www.keycloak.org/security

Threat actor / exploit-in-the-wild status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing are associated with CVE-2026-94218. No threat actor campaign is referenced in the available intelligence. The bypass is inferred from the vulnerability class; exploitation in the wild has not been confirmed.