Keycloak session enforcement bypass on policy upgrade

Confirmed. CVSS 3.1 (low). No active exploitation. Patch is out.

What it is

Keycloak’s authentication flow engine allows administrators to define and update authentication policies for realms and clients. When a stricter policy is applied, such as adding mandatory MFA, certificate-based authentication, or step-up flows, the expectation is that active sessions either immediately comply or are terminated. CVE-2026-94218 is a flaw in that enforcement.

The flaw: when an administrator upgrades a client’s or realm’s authentication policy to require stronger authentication, sessions that were issued under the previous policy continue to operate under the old policy until those sessions expire naturally or the user explicitly re-authenticates. The new requirement is bypassed. The window is determined by the session lifetime configuration; in environments with long-lived sessions, the bypass window can span hours or days.

Red Hat’s advisory identifies this as a session enforcement bypass in Keycloak’s authentication flow handling.

Scope

CVSS 3.1 (low) reflects a narrow threat model: exploiting this flaw requires an attacker to already hold a valid session issued before the policy upgrade. An external attacker cannot induce this condition on demand. The risk is meaningful for specific administrative scenarios.

The primary concern is the security incident response case. An administrator who detects a compromised account and responds by enforcing MFA or step-up authentication for the affected realm or client expects that change to take effect immediately for all active sessions. Under CVE-2026-94218, sessions already in flight continue operating under the previous policy. If the attacker holds an active session at the time of the policy upgrade, that session is not invalidated and does not trigger the new authentication requirement.

This is the session-race scenario: patch is applied, authentication requirements change, but the attacker’s window extends for the remainder of the session lifetime. In deployments where session lifetimes are configured to hours or more, that window is significant.

No unauthenticated path. Not on CISA’s Known Exploited Vulnerabilities catalog.

Affected configurations

The flaw affects any Keycloak deployment where authentication policy upgrades are made to clients or realms with active sessions. Specific risk factors that widen the bypass window:

• Long session lifetimes (default in some enterprise configurations can exceed 8 hours)
• Offline sessions enabled, which persist beyond browser close
• Client credentials flows using long-lived tokens
• Realms handling highly privileged accounts, where enforcement timing is critical during incident response

Deployments that invalidate all active sessions as part of policy change procedures are not effectively exposed during that transition.

Patch

Apply the patched Keycloak version listed in the Red Hat advisory. Red Hat published the advisory on September 21, 2026. After patching, verify that existing long-lived sessions in affected realms are invalidated. As an immediate mitigation prior to patch, administrators can force a realm session reset to remove pre-upgrade sessions: Keycloak supports this via the admin console (Realm Settings > Sessions > Logout all) and the Admin REST API.

Context

Session persistence behavior under policy changes is a known weakness category in IAM systems. The underlying issue, that session tokens encode the policy at time of issuance rather than dynamically evaluating current policy, is a design tradeoff between performance and correctness. Keycloak’s token validation model delegates this enforcement to the server session, which is where the bypass occurs.

The practical consequence is most visible in incident response. Security teams that rely on “apply stricter policy, session is revoked” as a remediation step need to confirm their IAM platform enforces that expectation before an incident occurs, not during one.

Keycloak handles authentication and session management for enterprises, government systems, and multi-tenant platforms. Flaws in session lifecycle enforcement affect every downstream service that trusts Keycloak session state.

The same September 21 Red Hat patch batch includes three other Keycloak CVEs: CVE-2026-94217 (CVSS 3.5, UMA token ownership confusion), CVE-2026-94213 (CVSS 4.9, Authorization Services policy evaluation exposure), and CVE-2026-94215 (CVSS 5.5, Admin REST API client cache flaw). Apply all four together.

Full coverage: Red Hat Patches Four Keycloak IAM Flaws. September 21 briefing: Sep 21: REDCap 9.8 RCE, Keycloak IAM, Jade Sleet Backdoors.