Keycloak 26.8.1: Admin Escalation, 2FA Bypass and PAR Replay Fixed

On 13 October 2026 the Keycloak project released 26.8.1, a patch release whose notes list 22 items under "Security fixes". Most carry their own CVE. The ones that matter most for identity teams are a privilege escalation from the manage-users role to realm-admin, a bypass of enforced 2FA setup, and a replay bug in Pushed Authorization Requests (PAR).

Keycloak 26.8.0 had shipped only twelve days earlier, on 1 October. If you upgraded to 26.8.0 for its new features, you are not done.

What's affected

The fixes land in Keycloak 26.8.1. The issue trackers for several of them also carry release/26.6.8 and release/27.0.0 labels, so backports to the 26.6 line are planned. At the time of writing the Keycloak blog lists 26.7.4 (16 September) and 26.7.5 (30 September) as the latest 26.7 releases, and neither is listed as carrying these fixes.

The highlights from the release notes and the linked GitHub issues:

• CVE-2026-94000, admin escalation through groups. A delegated admin holding only manage-users could add their own account, or a new one, to a group that maps an admin role. The issue reporter showed the group-membership endpoint returned HTTP 204 where the direct role-assignment endpoint correctly returned 403. Reproduced on 26.7.3. Advisory GHSA-3g7j-6fqv-v2q4.
• CVE-2026-94218, 2FA setup enforcement bypass. If you use a client policy with the auth-flow-enforcer executor to require a stronger flow, a user who had not yet enrolled OTP could hit the login-actions/restart endpoint, which cleared the flow selection without re-running the policy. Keycloak then fell back to the realm's default browser flow and the user signed in with a password only. Users who already had OTP were not affected.
• CVE-2026-96446, PAR single-use bypass via prompt=none. On the silent authentication path, the pushed request was never removed, so one request_uri could be replayed to mint several authorization codes. The reporter notes this breaks the single-use rule in RFC 9126 and FAPI 2.
• CVE-2026-97846. Standard Token Exchange skipped the required mTLS certificate binding.
• CVE-2026-94001 and CVE-2026-97177. Two separate paths (credential DELETE and a generic user update) let an admin get around a denied reset-password permission.
• CVE-2026-18569. The OIDC broker's backchannel logout accepted unsigned, forged logout tokens when signature validation was turned off on the identity provider.
• CVE-2026-96445. Conditional OTP trusted skip headers arriving on untrusted proxy paths.
• CVE-2026-94215. Cross-realm read and write through a session-level cache.
• CVE-2026-103884. Path traversal through an X.509 CRL Distribution Point, escaping the conf directory.
• CVE-2026-107121. SMTP with starttls=true allowed a plaintext downgrade of credentials and messages.

The full list also covers UMA scope merging, Kerberos KDC spoofing, an incomplete fix from 26.7.2 for group disclosure, a metrics cardinality issue on the broker login endpoint, and dependency updates for jackson-databind and simple-git.

How to check if you're exposed

Start with the version. On a running server:

curl -s https://keycloak.example.com/admin/serverinfo \
  -H "Authorization: Bearer $ADMIN_TOKEN" | jq -r '.systemInfo.version'

Or check the container image tag in your manifests:

grep -rnE "keycloak/keycloak:|rhbk/keycloak" k8s/ helm/ docker-compose*.yml

Then work out which of the headline bugs apply to your configuration:

1. Delegated admins. List every user or group holding manage-users in the realm-management client without also holding realm-admin. Those are the accounts that could escalate.
2. Groups that map admin roles. In the admin console, open each group and check Role mapping for any realm-management role.
3. Client policies. Under Realm settings, Client policies, look for profiles using the auth-flow-enforcer executor. If you rely on it to force 2FA, CVE-2026-94218 applies.
4. PAR and FAPI clients. Any client that sets "Pushed authorization request required" is in scope for CVE-2026-96446.
5. Brokered OIDC providers with "Validate signatures" switched off are in scope for CVE-2026-18569.

What to do now

1. Upgrade to Keycloak 26.8.1. Read the migration guide first if you are coming from 26.7.x, since 26.8.0 was a feature release.

2. If you can't upgrade this week, audit delegated admins. Remove manage-users from anyone who doesn't strictly need it, and check admin events for recent group joins into admin-mapped groups:

   kcadm.sh get admin-events -r myrealm \
     --fields operationType,resourcePath,time | grep -i groups
   

3. Review group memberships for admin-mapped groups and confirm every member is expected. Escalation leaves a durable result: an extra member in a privileged group.

4. Turn signature validation back on for brokered identity providers wherever the upstream supports it.

5. Check users who should have 2FA. List accounts in your enforced clients with no OTP credential and force enrollment through a required action.

6. Subscribe to the Keycloak blog feed so the next patch release reaches you the day it ships.

Why it matters

Several of these bugs share a pattern: one API path enforces a rule and a sibling path doesn't. Direct role assignment checked admin roles, group membership didn't. The credential reset permission was enforced on one endpoint and missed on two others. The SCIM path already had the right guard. When you review your own authorization code, look for every way to reach the same outcome, not just the obvious endpoint.

The 2FA and PAR bugs show something else. Flows that "restart" or "skip" steps are where state gets dropped. A user who can reset a flow to a weaker default has effectively chosen their own policy.

Keycloak is also a dependency, not just a server. It turns up in container images, Helm charts and vendor appliances, often pinned to whatever version the chart author chose.

Try it yourself

Pull the image tags for every Keycloak deployment you run into a list, then compare each against 26.8.1. If you find copies you didn't know about, that inventory gap is the real finding. The demo below shows how a dependency and component inventory surfaces things like an identity server buried in a base image.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Keycloak 26.8.1 released (keycloak.org)
• Keycloak blog release list
• keycloak/keycloak issue 53060: CVE-2026-94000
• keycloak/keycloak issue 53070: CVE-2026-94218
• keycloak/keycloak issue 53111: CVE-2026-96446
• Keycloak migration guide