{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-112208/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-112208"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Keycloak"],"_cs_severities":["high"],"_cs_tags":["cve-2026-112208","authentication-bypass","identity-access-management"],"_cs_type":"advisory","_cs_vendors":["Keycloak"],"content_html":"\u003cp\u003eA flaw exists in the Organization identity-first login flow of the Keycloak authentication server (CVE-2026-112208). An attacker who is a member of multiple organizations can trigger a state machine failure by initiating a login and subsequently switching to a registration or password reset flow. The application fails to clear a session flag representing a successful login, allowing the attacker to authenticate as a different user by providing that user's identifier. The server incorrectly treats the stale, pre-existing session flag as proof of the victim's identity.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can bypass authentication to gain full unauthorized access to a victim's account and all associated applications integrated with the compromised Keycloak instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all internet-facing Keycloak instances.\u003c/li\u003e\n\u003cli\u003eMonitor vendor security advisories for the release of a patch addressing CVE-2026-112208.\u003c/li\u003e\n\u003cli\u003eImplement strict monitoring for login flow anomalies where users frequently switch between authentication, registration, and password reset contexts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T18:23:04Z","date_published":"2026-11-05T18:23:04Z","id":"https://feed.craftedsignal.io/briefs/2026-11-keycloak-authentication-bypass/","summary":"A vulnerability in the Keycloak identity-first login flow allows an authenticated attacker belonging to multiple organizations to bypass authentication and perform a full account takeover of a victim.","title":"Keycloak: Authentication bypass in Organization identity-first login flow (CVE-2026-112208)","url":"https://feed.craftedsignal.io/briefs/2026-11-keycloak-authentication-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-112208","version":"https://jsonfeed.org/version/1.1"}