The flaw exists in the Device Authorization Grant of Keycloak’s OpenID Connect implementation. It allows a user who has stolen a legitimate password to obtain an access token without satisfying the client‑defined minimum authentication level, effectively bypassing mandatory multi‑factor authentication. This results in an attacker gaining unauthorized access to the Keycloak Administration REST API, providing the potential to modify or delete configuration, manage users, or elevate privileges within the protected realm.

This vulnerability affects Red Hat Build of Keycloak and Red Hat Single Sign‑On 7. No specific affected versions are listed in the data, but the issue applies to the OIDC Device Authorization Grant flow in these products.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog. The attack vectors require the attacker to have the user’s credentials and the ability to make requests to the Device Authorization endpoint, which is typically a remote interface. Once the token is obtained, the attacker can use the Admin REST API with the scope granted by the device authorization grant, thereby achieving unauthorized administrative access.