MEDIUM5.4

GHSA-5jfq-x6xp-7rw2

Keycloak vulnerable to two factor authentication bypass

Quick fix

GHSA-5jfq-x6xp-7rw2 — org.keycloak:keycloak-services: upgrade to the fixed version with the command below.

# pom.xml: bump <version>26.2.2</version> for org.keycloak:keycloak-services

Details

# Description A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.keycloak:keycloak-services

Introduced in: 0Fixed in: 26.2.2

Fix# pom.xml: bump <version>26.2.2</version> for org.keycloak:keycloak-services

References

https://github.com/keycloak/keycloak/security/advisories/GHSA-5jfq-x6xp-7rw2[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2025-3910[ADVISORY]
https://github.com/keycloak/keycloak/issues/39349[WEB]
https://access.redhat.com/errata/RHSA-2025:4335[WEB]
https://access.redhat.com/errata/RHSA-2025:4336[WEB]
https://access.redhat.com/security/cve/CVE-2025-3910[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=2361923[WEB]
https://github.com/keycloak/keycloak[PACKAGE]