CVE-2026-94218

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the authentication session management allows users to bypass mandatory security requirements, such as two-factor authentication (2FA) setup, enforced via client policies. By manually accessing a session restart web link during the login process, a user can clear internal markers that track required security steps, enabling access using only a password.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.