This vulnerability in Red Hat Build of Keycloak arises from improper clearing of authentication session notes at the session restart endpoint without re-evaluating active client policies. When an administrator enforces stronger authentication flows such as mandatory 2FA setup, a user can bypass this enforcement by manually accessing a session restart web link during login. This action removes internal markers that enforce the 2FA requirement, allowing the user to authenticate with only a password and obtain a token at the realm's default authentication level. The issue specifically affects configurations using client policies with auth-flow-enforcer and users who have not completed 2FA enrollment. Red Hat has assigned a CVSS 3.1 score of 3.1 (low severity) and has not provided a patch or mitigation that meets their criteria for ease of use, applicability, or stability.

Successful exploitation allows an attacker to bypass a mandated 2FA setup step and gain access with only a password, potentially reducing the security level of the authentication process. The impact is limited to users who have not yet enrolled in 2FA and requires a specific client policy configuration. There is no direct confidentiality or availability impact, but integrity impact is rated low due to the ability to bypass authentication flow enforcement.

Red Hat currently does not offer a mitigation or patch that meets their criteria for deployment ease, applicability, or stability. Users should monitor the Red Hat advisory for updates. Since the vulnerability requires a specific configuration and affects only users not enrolled in 2FA, administrators may consider alternative enforcement strategies or manual monitoring until an official fix is released.