CVE-2026-118959 | BDVDB-2026-398405 Detail

Description#

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-30Record published in the CVE List.
2. Version 22026-11-03Most recent update recorded in the CVE List.