This vulnerability in Red Hat Build of Keycloak arises from a logic error in the Level of Authentication (LoA) enforcement during session re-evaluation. When a client requests a higher authentication level for a user who already has an active session at a lower level, Keycloak may incorrectly issue a token at the lower level due to failure to execute the forced-level validation callback if all LoA-gated conditional sub-flows are disabled. This can allow bypassing mandatory step-up authentication and unauthorized access to resources dependent on these security claims. The issue requires a specific browser flow and an existing session to exploit. Red Hat has assessed the severity as moderate with a CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). No patch or mitigation that meets Red Hat's standards is currently available.

An attacker who can exploit this vulnerability may bypass mandatory step-up authentication requirements, obtaining tokens that assert a higher level of authentication than actually performed. This could lead to unauthorized access to sensitive resources that rely on these security claims. The impact includes potential confidentiality and integrity violations by reading or modifying sensitive data. Exploitation requires a specific browser flow configuration and an active session, limiting the attack surface. There is no indication of availability impact.

Red Hat states that no mitigation is currently available or meets their criteria for ease of use, applicability, and stability. Users should monitor Red Hat's advisory for updates on fixes or mitigations. Since no official fix or workaround is provided, organizations should assess their exposure based on their usage of Keycloak and the likelihood of the specific browser flow and session conditions required for exploitation.