CVE-2026-96446

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Pushed Authorization Request (PAR) implementation. When the silent authentication path prompt=none is used, the authorization process may skip specific steps for users who are already logged in. This bypass prevents the enforcement of the security rule requiring that a pushed request URI be used only once. Consequently, an attacker could reuse a request URI to obtain multiple authorization codes for an authenticated user, which violates FAPI-2 security standards.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.