Live › vulnerability › CVE-2026-114438
Go to dashboardWhen the Update User Locale required action is ordered before Configure OTP in a realm, Keycloak may not enforce mandatory OTP enrollment during login. An attacker with a valid password can reach the account without setting up the required one-time password credential.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Realms that require OTP enrollment through required actions and have Update User Locale ordered before Configure OTP are exposed. Realms that do not enforce mandatory OTP enrollment, or that order Configure OTP first, are unlikely to be affected. The sources do not give more detail.
No product ranges from the sources yet.
unknown (the sources do not name fixed versions)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.
This page as .md · .json · in your agent: get_signal("CVE-2026-114438")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.