Keycloak Account REST API Improper Access Control Vulnerability Allowing MFA Bypass and Account Takeover

A vulnerability exists in the Account REST API of Keycloak, where improper access control allows users authenticated at a lower security level to perform actions reserved for higher-assurance sessions. An attacker with a victim's password can delete the victim's multi-factor authentication (MFA) credential without verifying possession of that factor. This enables the attacker to register their own MFA device, gaining full control of the account. The issue arises from insufficient validation of the authentication Level of Assurance (LoA), undermining the protection intended by MFA.

Impact

Exploitation of this vulnerability can lead to unauthorized deletion of MFA credentials, allowing attackers to take over accounts by registering their own MFA devices.