Keycloak: Authentication bypass in Organization identity-first login flow (CVE-2026-112208)

A flaw exists in the Organization identity-first login flow of the Keycloak authentication server (CVE-2026-112208). An attacker who is a member of multiple organizations can trigger a state machine failure by initiating a login and subsequently switching to a registration or password reset flow. The application fails to clear a session flag representing a successful login, allowing the attacker to authenticate as a different user by providing that user's identifier. The server incorrectly treats the stale, pre-existing session flag as proof of the victim's identity.

Impact

An attacker can bypass authentication to gain full unauthorized access to a victim's account and all associated applications integrated with the compromised Keycloak instance.

Recommendation

• Inventory all internet-facing Keycloak instances.
• Monitor vendor security advisories for the release of a patch addressing CVE-2026-112208.
• Implement strict monitoring for login flow anomalies where users frequently switch between authentication, registration, and password reset contexts.