CVE-2026-97176

Executive Summary

CVE-2026-97176 is a logic-error vulnerability in Keycloak's Level of Authentication (LoA) enforcement mechanism. When a client requires a higher authentication security level than the level at which a user's existing session was established, Keycloak may fail to correctly re-evaluate the session and issue a token at the lower level instead. This allows an authenticated low-assurance session to access resources that rely on higher-assurance security claims, undermining step-up authentication controls; the weakness is rated CVSS 4.2 (Medium) and remains unpatched as of this report.

Technical Analysis

Keycloak is an open-source identity and access management (IAM) solution that issues OAuth 2.0 / OpenID Connect tokens and enforces authentication requirements per client (relying party). Central to this CVE is the Level of Authentication (LoA) concept: clients may declare that a given user must satisfy a specific authentication strength (e.g., multi-factor or a higher assurance level) before being granted access. Keycloak tracks the authentication level of a session and is expected to enforce, at token issuance time, that the session's assurance meets the client's requirement.

The NVD description states the flaw is a logic error in how session re-evaluations are handled. The vulnerable condition arises specifically when:

• A user already holds an active session established at a lower security level, and
• A client then explicitly requires a higher security level for that same user.

In this situation the correct behavior would be to force a re-authentication / step-up so that the session is elevated to the required LoA before a token is issued. Instead, Keycloak may incorrectly issue a token at the lower security level rather than enforcing the higher level. This is mapped to CWE-862 (Missing Authorization): an authorization check that should gate token issuance to a privileged assurance level is effectively skipped or performed incorrectly.

The root cause is a state-management / re-evaluation defect — the session's assurance is not correctly re-assessed against the stricter per-client requirement, so a stale lower-assurance evaluation is used to mint the token. This is not a memory-safety or injection flaw; it is an access-control logic defect. The CVSS vector AC:H reflects the precondition that a lower-level session must already be active and a higher-LoA client must request access, while PR:L reflects that the attacker must already possess valid low-assurance credentials. Both C:L and I:L indicate limited confidentiality and integrity impact flowing from access to resources that trust the higher LoA claim.

Insufficient technical detail is available to describe specific internal classes, methods, or session-handling code paths, as the advisory does not disclose them; the analysis above is confined to the behavior described in the NVD entry.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-97176. The attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker fingerprints a Keycloak deployment (e.g., standard login/realm endpoints and server headers) and identifies a protected client/relying party that requires a higher authentication level than the attacker can or chooses to satisfy. This is typically a sensitive application (admin console, financial or PII-bearing service) gated behind step-up authentication.

2. Establishing the low-assurance foothold. Using valid but low-assurance credentials (the PR:L precondition), the attacker authenticates and obtains an active session at a lower LoA. No privilege escalation or exploit primitive is needed at this step — only legitimate, weaker authentication.

3. Triggering the logic error. The attacker directs the same session toward the client that requires the higher security level. Because of the flawed re-evaluation logic, Keycloak fails to force step-up and instead issues a token at the lower security level to the high-requirement client.

4. Post-exploitation impact. The attacker presents this improperly-issued token to resources that rely on the LoA security claim. Those resources trust the claim and grant access, yielding unauthorized access to sensitive resources — the exact outcome flagged in the advisory — with limited confidentiality and integrity impact (C:L/I:L). No availability impact (A:N) is expected from this flaw itself.

Because the flaw is an authorization-logic bypass rather than a remote code execution primitive, the practical result is authentication-assurance bypass, allowing a weakly-authenticated principal to masquerade as a strongly-authenticated one for downstream relying parties.

Impact Assessment

• Confidentiality (C:L): Access to resources that assume higher-assurance authentication may expose limited sensitive data.
• Integrity (I:L): Token-based actions trusted at the higher LoA may be performed by a lower-assured principal, enabling limited unauthorized modification.
• Availability (A:N): No availability impact.
• Attack Vector (AV:N): Remotely exploitable over the network against the IAM service.
• Attack Complexity (AC:H): Requires the environmental precondition of a pre-existing lower-level active session plus a client demanding a higher level.
• Privileges Required (PR:L): The attacker must already hold valid low-assurance credentials.
• User Interaction (UI:N): No victim interaction required beyond the attacker's own session.
• Scope (S:U): Impact confined to the authorization decision boundary of Keycloak.

Business impact: Organizations relying on Keycloak LoA/step-up authentication to protect high-value applications face an authentication assurance bypass. Multi-factor or elevated-assurance requirements — often mandated for compliance (e.g., protecting administrative, financial, or regulated data) — can be silently down-graded to single-factor, undermining zero-trust postures and audit commitments. Blast radius is bounded by how many clients enforce LoA claims and how many users legitimately hold weaker sessions. No CISA KEV listing and no EPSS score are available, indicating no confirmed in-the-wild exploitation at time of writing.

Detection Guidance

Detection for an authorization-logic flaw is challenging because the abuse uses legitimate endpoints and valid credentials. Focus on anomalous token issuance patterns, mismatches between required and granted authentication level, and step-up anomalies.

Sigma Rule

title: Keycloak Token Issued Below Required Level of Authentication
id: 7b2c9f14-3a6d-4e91-9c2f-1f0a5e8d4c77
status: experimental
description: Detects Keycloak events where a token/authorization is granted to a client requiring a higher Level of Authentication (LoA) than the session actually satisfied (CVE-2026-97176).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97176
author: valtersit.com
date: 2026/01/01
logsource:
  product: keycloak
  service: events
detection:
  selection:
    event_type:
      - 'CLIENT_LOGIN'
      - 'CODE_TO_TOKEN'
      - 'REFRESH_TOKEN'
  keywords:
    required_loa: '*'
  filter_mismatch:
    - granted_loa|lt_than: required_loa
  condition: selection and filter_mismatch
falsepositives:
  - Legitimate step-up re-authentication flows that correctly elevate the session
  - Administrative configuration changes to client LoA requirements
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.97176

YARA Rule

rule CVE_2026_97176_Keycloak_LoA_Bypass
{
    meta:
        description = "Detects Keycloak LoA enforcement bypass indicators in logs or config artifacts (CVE-2026-97176)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97176"
        cve = "CVE-2026-97176"
        severity = "medium"

    strings:
        $loa1 = "Level of Authentication" ascii nocase
        $loa2 = "LoA" ascii
        $loa3 = "acr_values" ascii nocase
        $loa4 = "loa" ascii nocase
        $evt1 = "CODE_TO_TOKEN" ascii
        $evt2 = "CLIENT_LOGIN" ascii

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x504B0304) and
        (
            (2 of ($loa1, $loa2, $loa3)) or
            ($loa4 and 1 of ($evt1, $evt2))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97176 Keycloak Level of Authentication Bypass Attempt - High LoA Client Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/realms/"; content:"/protocol/openid-connect/auth"; http.header; content:"acr_values"; reference:cve,CVE-2026-97176; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97176; classtype:attempted-user; sid:202697176; rev:1;)

Elastic Detection

sequence by user.name with maxspan=10m
  [ authentication where event.action == "login" and keycloak.authentication.level == "low" ]
  [ authentication where event.action in ("code_to_token","client_login")
      and keycloak.client.required.level == "high"
      and keycloak.token.granted.level == "low" ]

Splunk SPL Query

index=keycloak sourcetype=keycloak:events (event_type=CODE_TO_TOKEN OR event_type=CLIENT_LOGIN OR event_type=REFRESH_TOKEN)
| eval required_loa=coalesce(required_loa, client_loa_requirement)
| eval granted_loa=coalesce(granted_loa, session_loa)
| where tonumber(required_loa) > tonumber(granted_loa)
| stats count values(clientId) as clients values(userId) as users by ipAddress, required_loa, granted_loa
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="keycloak,cve-2026-97176,">
  <rule id="2026971" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">CODE_TO_TOKEN|CLIENT_LOGIN|REFRESH_TOKEN</field>
    <field name="required_loa">\d+</field>
    <field name="granted_loa">\d+</field>
    <description>CVE-2026-97176: Keycloak issued token below required Level of Authentication</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, no OSV release data, and no workaround are currently available from any tracked source.

1. Immediate mitigations

   • Audit all clients configured to require a higher Level of Authentication and verify (via test sessions) that a pre-existing lower-level session is genuinely forced to step up before token issuance.
   • Where possible, shorten session lifetimes and force re-authentication for high-assurance clients so stale low-level sessions cannot be reused.
   • Restrict the number of clients relying on LoA/acr_values step-up until the enforcement defect is confirmed resolved.
   • Enable and centralize Keycloak event logging (CODE_TO_TOKEN, CLIENT_LOGIN, REFRESH_TOKEN) and alert on required-vs-granted level mismatches using the detection rules above.

2. Patch / upgrade steps

   • No patch is available; monitor the Keycloak security advisories and release notes for a fix addressing the LoA/session re-evaluation logic.
   • When a fixed release is published, upgrade all Keycloak nodes consistently and invalidate existing sessions/tokens to prevent stale low-assurance sessions persisting across the upgrade.

3. Long-term hardening

   • Treat step-up authentication as a security-critical control and add regression tests that verify LoA enforcement when a lower-level session already exists.
   • Adopt defense-in-depth so downstream relying parties do not solely trust the LoA claim but also validate token context (e.g., acr/amr) server-side.
   • Enforce short token TTLs and stronger session-binding for high-assurance resources, and monitor continuously for assurance-level downgrades.

References

• NVD — CVE-2026-97176: https://nvd.nist.gov/vuln/detail/CVE-2026-97176
• Keycloak project security advisories: https://www.keycloak.org/security
• Keycloak documentation — Server Administration / Step-up authentication: https://www.keycloak.org/documentation
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or known threat-actor campaign has been observed for CVE-2026-97176 at time of publication.