CVE-2026-105305

MediumCVSS 5.4/10Last modified Oct 6, 2026

Description

A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 6, 2026
Last modified: Oct 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1053066.5A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the CVE-2026-1053077.3A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the compone CVE-2026-105315.4The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them CVE-2026-1053117.7The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set s CVE-2026-1053129.9A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imag CVE-2026-1053147.5Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file CVE-2026-1053154.7A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsear CVE-2026-1053167.1The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available CVE-2026-1053178.5Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.CVE-2026-1053187.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newslette CVE-2026-105322.9Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allow CVE-2026-1053225.3The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, all