red-hatCVE-2026-96446
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak.
Medium4.2CVE-2026-96446 · Published Sep 23, 2026 · updated Sep 24, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak Vendor | all versions | No fix yet |
| all versions | No fix yet | |
| Red Hat Single Sign-On 7 Vendor | all versions | No fix yet |
Details and references
A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Severity from
- no source yet
- Weakness
- CWE-862