CVE-2026-96446
Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path
CVSS Score
4.2
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2.
| CWE | CWE-862 |
| Vendor | red hat |
| Product | red hat build of keycloak |
| Published | Sep 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat build of keycloak
Be the first to know when new medium vulnerabilities affecting red hat red hat build of keycloak are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Red Hat / Red Hat Build of Keycloak
All versions affected Red Hat / Red Hat Build of Keycloak
All versions affected Red Hat / Red Hat Single Sign-On 7
All versions affected