CVE-2026-118959 in Keycloak
Summary
by MITRE • 10/30/2026
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Keycloak stems from a logical flaw within its required action provider mechanism, specifically concerning how the system handles mandatory actions during the authorization flow. When an authentication request is initiated by an application and includes the kc_action query parameter set to a specific mandatory action already assigned to the user account, such as profile verification or acceptance of terms and conditions, Keycloak fails to enforce the completion of that action before proceeding. This behavior deviates from the expected security model where administrative requirements must be satisfied prior to granting access tokens or authorization codes. The root cause lies in the incorrect handling logic for application-initiated actions, which allows the system to bypass these mandatory challenges under certain conditions, effectively treating them as optional rather than compulsory prerequisites for authentication completion.
From a technical perspective, this flaw represents a significant breakdown in identity governance controls. In standard OAuth 2.0 and OpenID Connect flows managed by Keycloak, required actions serve as critical checkpoints that ensure users comply with organizational policies before being granted access to protected resources. By skipping these checks when the kc_action parameter is present alongside an already assigned mandatory action, the system creates a path for privilege escalation through identity manipulation. An attacker or malicious actor can exploit this logic error by crafting specific authorization requests that trigger this bypass condition. Consequently, the authentication server issues an authorization code without verifying that the user has actually completed the required steps, such as updating their profile information or explicitly agreeing to legal terms and conditions.
The operational impact of this vulnerability is severe, particularly in environments where compliance with regulatory standards or internal security policies is mandatory. Users can bypass administrative requirements and gain immediate access to applications without fulfilling necessary obligations. This undermines the integrity of identity management systems and exposes organizations to risks associated with non-compliance, such as violating GDPR provisions regarding user consent or failing to enforce password rotation policies if those are configured as required actions. Furthermore, it erodes trust in the authentication process, as the system fails to guarantee that all security prerequisites have been met before issuing credentials that allow access to sensitive data and services.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically where an entity claims a different identity than its true one due to flawed logic rather than credential theft. It also relates to CWE-693, Protection Mechanism Failure, as the security controls designed to enforce policy compliance are circumvented by incorrect implementation of those mechanisms. In terms of MITRE ATT&CK framework techniques, this flaw facilitates Initial Access through exploitation of authentication bypass vulnerabilities, allowing adversaries or malicious insiders to gain footholds in systems without proper authorization checks.
To mitigate this risk, administrators should immediately apply the latest security patches provided by Keycloak that address the required action provider logic. Until updates are applied, it is advisable to review application configurations and restrict the use of the kc_action parameter if possible, ensuring that mandatory actions are enforced through alternative means such as strict policy enforcement at the realm level rather than relying solely on query parameters during authorization requests. Regular audits of authentication logs can help detect instances where required actions were skipped, allowing for timely identification of potential exploitation attempts. Additionally, organizations should ensure that their identity and access management policies explicitly account for this vulnerability by implementing compensating controls such as session validation checks or additional verification steps at the application layer to verify compliance with mandatory requirements before granting full access privileges.