A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower
    security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an
    attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP
    credential without first proving possession of that factor. The attacker can then register their own MFA
    device, effectively taking full control of the account. This weakness undermines the intended protection
    provided by multi-factor authentication. (CVE-2026-3429)

Keycloak versions installed prior to 26.4.11 are affected by multiple vulnerabilities:

  - A flaw was identified in the Account REST API of Keycloak that allows a user authenticated   at a lower security level to perform sensitive actions intended only for higher-assurance   sessions. Specifically, an attacker who has already obtained a victim's password can delete   the victim's registered MFA/OTP credential without first proving possession of that factor.
  The attacker can then register their own MFA device, effectively taking full control of the   account. This weakness undermines the intended protection provided by multi-factor   authentication. (CVE-2026-3429)

  - A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin   API allows any authenticated user, even those without administrative privileges, to   enumerate the organization memberships of other users. This information disclosure occurs   if the attacker knows the victim's unique identifier (UUID) and the Organizations feature   is enabled. (CVE-2026-2366)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
458069	Echo: keycloak-25: security update to 25.0.6+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458069	Echo: keycloak-25: security update to 25.0.6+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
305939	Keycloak < 26.4.11 Multiple Vulnerabilities	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-3429

medium

Tenable Plugins

medium

medium

medium