REDHAT-BUG-2561991: Medium severity Red Hat Keycloak vulnerability
A flaw was found in Keycloaks Pushed Authorization Request PAR implementation. The fix for CVE-2026-96446 moved PAR consumption to authentication completion by checking for the AUTHORIZATIONREQUESTURI authentication session note. However, triggering an authentication flow restart via /login-actions/restart clears authentication session notes while preserving client notes including request parameters such as redirecturi, scope, state, and nonce. Consequently, when authentication completes after a flow restart, the PAR consumption check is skipped, leaving the requesturi active in the single-use store. An attacker can replay the same requesturi within its valid lifespan default 60 seconds to obtain a second authorization grant and distinct access token. This bypasses the single-use guarantee required by RFC 9126. Successful exploitation allows an attacker to mint multiple authorization codes and access tokens from a single pushed request.
Affected Software
Event History
Frequently Asked Questions
What must occur for the single-use protection to be bypassed?
An authentication flow restart must be triggered through /login-actions/restart after a pushed authorization request has been created. The restart clears the authentication-session note used to consume the request while preserving client request parameters.
What can an attacker do with a replayed request_uri?
The same request_uri can be replayed to obtain a second authorization grant, including a distinct authorization code and access token. This allows multiple codes and tokens to be minted from one pushed request.
How long is the replay window?
The request_uri remains replayable for its valid lifespan, which is 60 seconds by default. The vulnerability exists because the request is left active in the single-use store after the restarted authentication flow completes.