CVE-2026-96446 Red Hat CVE debrief

Who should care

Defenders responsible for Keycloak configurations, especially those using the silent authentication path, should assess exposure and verify the use of the Pushed Authorization Request PAR implementation.

Why it matters

Defenders should care about CVE-2026-96446 because it affects Keycloak's Pushed Authorization Request PAR implementation, potentially allowing attackers to reuse request URIs and obtain multiple authorization codes when the silent authentication path is used.

• Potential reuse of request URIs to obtain multiple authorization codes
• Bypass of security rules ensuring pushed request URIs are used only once

Technical summary

The issue occurs when the silent authentication path prompt=none is used, allowing the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. This allows an attacker to potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2. The flaw affects Keycloak's Pushed Authorization Request PAR implementation.

Defensive priority

Defenders should prioritize verifying the use of the Pushed Authorization Request PAR implementation in their Keycloak configurations, especially when the silent authentication path is used.

Recommended defensive actions

• Verify the use of the Pushed Authorization Request PAR implementation in Keycloak configurations
• Review and update Keycloak configurations to ensure the security rule is enforced
• Confirm whether affected Keycloak deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details about the flaw in Keycloak's Pushed Authorization Request PAR implementation. The issue allows an attacker to potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in. Evidence is limited to public CVE and NVD information. Defenders should verify Keycloak configurations and review the official CVE record and NVD entry for further details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.