CVE-2026-97176

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Level of Authentication enforcement mechanism of Keycloak. The issue arises when a client requires a higher security level for a user who already possesses an active session at a lower level. A logic error during session re-evaluations may cause Keycloak to incorrectly issue a token at the lower security level instead of enforcing the required higher level, which could allow unauthorized access to sensitive resources relying on these security claims.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.