REDHAT-BUG-2545801: Medium severity Keycloak Keycloak vulnerability
A flaw was found in the org.keycloak.protocol.oidc package of Keycloak. The OAuth 2.0 Device Authorization Grant flow does not correctly enforce the per-client minimum.acr.value setting. While the standard Authorization Code flow properly requires multi-factor authentication (MFA) when this setting is present, the Device Authorization flow allows authentication to complete at a lower Level of Assurance (LoA 1, password only). The root cause is a missing validation step in the device grant code path to ensure the resulting authentication context class reference (ACR) meets the client's configured minimum. An attacker with knowledge of a user's primary credentials can exploit this to bypass MFA requirements. Successful exploitation allows the attacker to obtain a valid access token with the client's scoped roles and use it to perform unauthorized actions via the Keycloak Admin REST API, such as managing users or modifying realm configurations.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the OAuth 2.0 Device Authorization Grant flow for a client that has a per-client minimum.acr.value configured are exposed. The standard Authorization Code flow is described as correctly enforcing the MFA requirement.
What does an attacker need to exploit the issue?
An attacker needs knowledge of a user's primary credentials. They can then use the Device Authorization flow to authenticate at LoA 1 with a password rather than satisfying the client's configured MFA requirement.
What access could an attacker gain after successful exploitation?
The attacker can obtain a valid access token carrying the affected client's scoped roles. Those permissions may allow unauthorized Keycloak Admin REST API actions, including managing users or modifying realm configuration.