CVE-2026-112208
Last modified
CVE-2026-112208 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services.
Description
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Build of Keycloak | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-112208?
How severe is CVE-2026-112208?
How do I fix CVE-2026-112208?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-112199Improper Neutralization of Input During Web Page Generation …6.5
- CVE-2026-1122A vulnerability was determined in Yonyou KSOA 9.0. This impa…9.8
- CVE-2026-11220Insufficient validation of untrusted input in Navigation in …6.5
- CVE-2026-112200P-Net before 1.0.3 does not release the Application Relation…8.7
- CVE-2026-112202Imager::File::GIF versions before 1.006 for Perl allow out-o…6.5
- CVE-2026-112207The Download Monitor WordPress plugin before 5.3.4 does not …7.1
- CVE-2026-11221Insufficient validation of untrusted input in PointerLock in…4.3
- CVE-2026-112210A flaw was found in the rhc-canonical-facts.service systemd …6
- CVE-2026-112211Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-112212GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
- CVE-2026-112214A flaw was found in the GStreamer ASF demuxer in gst-plugins…6.5
- CVE-2026-112218Missing Authorization vulnerability in Ahmad Majestic Suppor…5.3
Are you affected by CVE-2026-112208?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST