CVE-2026-105305: Improper Authentication in Red Hat Red Hat Build of Keycloak

This vulnerability exists in the OIDC Device Authorization Grant flow implementation of Red Hat Build of Keycloak. The flow is designed for devices with limited input capabilities to obtain security tokens. However, it fails to verify the minimum authentication level set by client configurations, allowing an attacker who possesses a user's password to bypass mandatory multi-factor authentication. This can lead to unauthorized access to the Keycloak Admin REST API, potentially compromising administrative functions.

An attacker who has stolen a user's password can bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API. This could lead to unauthorized administrative actions within Keycloak, potentially impacting confidentiality and integrity of the system. The CVSS v3.1 base score is 5.4 (medium), reflecting the network attack vector, low attack complexity, and the requirement of some privileges but no user interaction.

Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-105305 for current remediation guidance. Until a patch or official fix is available, consider restricting access to the Admin REST API and monitoring for suspicious activity related to authentication bypass attempts.