5.4
MediumCVSS 3.1 · from redhat
CVE-2026-118959
Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter
keycloak-services · Improper authentication · CWE-287Affectedkeycloak-services, rhbk/keycloak-rhel9, keycloak-services
FixNo fix listed yet.
PublishedOct 30, 00:15 · redhat
ScoredOct 30 · 5.4 · redhat
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.
From redhat
Affected and fixed versions
ProductAffectedFixed inkeycloak-servicesall versions–rhbk/keycloak-rhel9all versions–keycloak-servicesnot stated–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known