Keycloak Two-Factor Authentication Bypass Vulnerability

A vulnerability in Keycloak's authorization package allows users to bypass required actions, such as setting up two-factor authentication. This issue affects the Red Hat build of Keycloak 26.0.11.

Impact

Exploitation of this vulnerability allows users to circumvent two-factor authentication requirements, potentially leading to unauthorized access.

Reproduction

To reproduce this vulnerability, a user account must be configured by an administrator to perform a required action, such as setting up two-factor authentication. During the sign-in process, the user can then pass a URL parameter to bypass the requirement.

Remediation

Users can update to the Red Hat build of Keycloak 26.0.11 to address this vulnerability.