Bug 2545801 (CVE-2026-105305)

Summary: CVE-2026-105305 keycloak-services: keycloak-services: Device Authorization Grant bypasses per-client minimum.acr.value enforcement
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-05 05:38:36 UTC 
A flaw was found in the org.keycloak.protocol.oidc package of Keycloak. The OAuth 2.0 Device Authorization Grant flow does not correctly enforce the per-client minimum.acr.value setting. While the standard Authorization Code flow properly requires multi-factor authentication (MFA) when this setting is present, the Device Authorization flow allows authentication to complete at a lower Level of Assurance (LoA 1, password only).
The root cause is a missing validation step in the device grant code path to ensure the resulting authentication context class reference (ACR) meets the client's configured minimum. An attacker with knowledge of a user's primary credentials can exploit this to bypass MFA requirements. Successful exploitation allows the attacker to obtain a valid access token with the client's scoped roles and use it to perform unauthorized actions via the Keycloak Admin REST API, such as managing users or modifying realm configurations.