Red Hat Keycloak/Single Sign-On Required Action Provider kc_action improper authorization

Summaryinfo

A vulnerability has been found in Red Hat Keycloak and Single Sign-On and classified as critical. Affected is an unknown function of the component Required Action Provider. Performing a manipulation of the argument kc_action results in improper authorization. This vulnerability was named CVE-2026-118959. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in Red Hat Keycloak and Single Sign-On (the affected version unknown). This affects an unknown part of the component Required Action Provider. The manipulation of the argument kc_action with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.

It is possible to read the advisory at access.redhat.com. This vulnerability is uniquely identified as CVE-2026-118959 since 10/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 10/30/2026). The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-113443). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Red Hat

Name

• Keycloak
• Single Sign-On

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion