CVE-2026-96446
Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path
CVSS Score
4.2
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2.
| CWE | CWE-862 |
| Vendor | red hat |
| Product | red hat build of keycloak 26.6.8 |
| Published | Sep 23, 2026 |
| Last Updated | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat build of keycloak 26.6.8
Be the first to know when new medium vulnerabilities affecting red hat red hat build of keycloak 26.6.8 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Red Hat / Red Hat build of Keycloak 26.6.8
All versions affected Red Hat / Red Hat build of Keycloak 26.6.8
All versions affected Red Hat / Red Hat Single Sign-On 7
All versions affected References
Credits
Red Hat would like to thank EVIL0RD (Independent Security Researcher) for reporting this issue.