REDHAT-BUG-2539964: Medium severity Red Hat Keycloak vulnerability
A flaw was found in Keycloak's Level of Authentication (LoA) enforcement within the ConditionalLoaAuthenticator component. When a client requests a specific acr level as essential:true via the OIDC claims request parameter and an existing SSO session is present, Keycloak can silently issue a token asserting a lower acr level than required without triggering the mandatory forced-level failure. The vulnerability exists because when the browser flow re-evaluates an existing session via the Cookie authenticator, LoA-gated Conditional sub-flows may be disabled (e.g., if the user lacks the required credentials for the higher level). In this scenario, the ConditionalLoaAuthenticator fails to register its top-flow-success callback. Consequently, the onTopFlowSuccess() method is never executed, and the mandatory forced-level check is bypassed. An authenticated attacker with a valid low-level session can exploit this to obtain tokens for clients requiring higher authentication levels (essential:true) without providing the necessary additional factors. This results in an authentication level bypass for relying parties that trust the acr claim to guarantee the level was verified during the current authentication.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this authentication-level bypass?
Relying parties are exposed if they require a specific ACR level through an OIDC claims request with essential:true and trust the returned acr claim as proof that the higher authentication level was verified. The issue applies when an existing Keycloak SSO session is re-evaluated during the browser flow.
What does an attacker need to exploit the issue?
An attacker needs to already be authenticated with a valid low-level SSO session. They can then request a token for a client requiring a higher essential ACR level without supplying the additional factors needed for that level.
What configuration condition makes exploitation possible?
The bypass occurs when LoA-gated conditional sub-flows are disabled during Cookie authenticator processing, such as when the user does not have credentials required for the higher authentication level. This prevents ConditionalLoaAuthenticator from registering the callback that performs the mandatory forced-level check.
How can an organization determine whether its relying parties may be affected?
Review clients that send OIDC claims requests requiring an ACR value with essential:true, especially where access decisions rely on the acr claim. They may be affected if users with existing lower-level SSO sessions can request tokens without being forced to complete the higher-level authentication factors.