{"id":"CVE-2026-114438","kind":"vulnerability","aliases":["CVE-2026-114438"],"related":[],"title":"Keycloak: locale required action can skip mandatory OTP enrollment at login","description":"A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.","summary":"When the Update User Locale required action is ordered before Configure OTP in a realm, Keycloak may not enforce mandatory OTP enrollment during login. An attacker with a valid password can reach the account without setting up the required one-time password credential.","severity":"medium","cvss":4.2,"epss":0.0016,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","keycloak","package","self-hosted","sso"],"not_affected_if":["default-config","no-mandatory-otp"],"how_to_check":"- Check the Keycloak version in use: `unknown` (the sources do not name fixed versions)\n- In the admin console, review the realm's Required Actions order and see whether Update User Locale is listed above Configure OTP\n- Check whether any realm requires OTP enrollment for users: unknown","fix":"- Upgrade Keycloak to a fixed release: unknown (the sources do not name one)\n- Reorder required actions so Configure OTP runs before Update User Locale, as a workaround: unknown (not confirmed by the sources)","status":"open","published_at":"2026-10-21T20:17:26+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:41:29+00:00","updated_at":"2026-10-25T04:41:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:41:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Keycloak to a fixed release: unknown (the sources do not name one)\n- Reorder required actions so Configure OTP runs before Update User Locale, as a workaround: unknown (not confirmed by the sources)","reach":"internet","title":"Keycloak: locale required action can skip mandatory OTP enrollment at login","impact":"medium","summary":"When the Update User Locale required action is ordered before Configure OTP in a realm, Keycloak may not enforce mandatory OTP enrollment during login. An attacker with a valid password can reach the account without setting up the required one-time password credential.","category":"package","nicknames":[],"who_cares":["keycloak","self-hosted","identity","sso"],"confidence":0.6,"needs_auth":"yes","worst_case":"Account accessed with only a password, skipping required OTP enrollment","analyst_note":"Find the affected and fixed Keycloak versions and the advisory at the NVD link or the Keycloak project security page.","how_to_check":"- Check the Keycloak version in use: `unknown` (the sources do not name fixed versions)\n- In the admin console, review the realm's Required Actions order and see whether Update User Locale is listed above Configure OTP\n- Check whether any realm requires OTP enrollment for users: unknown","needs_analyst":true,"not_affected_if":["no-mandatory-otp","default-config"],"who_is_affected":"Realms that require OTP enrollment through required actions and have Update User Locale ordered before Configure OTP are exposed. Realms that do not enforce mandatory OTP enrollment, or that order Configure OTP first, are unlikely to be affected. The sources do not give more detail.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000644,"input_tokens":3368,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114438':14A,17A '-2026':13A,16A 'access':85C,127C 'account':58B,129C 'action':4A,31B,79C,90C,97C 'allow':119C 'attack':50B,121C 'authent':111C 'configur':35B,95C 'credenti':68B,140C 'cve':12A,15A 'enforc':43B,106C 'enrol':9A,46B,112C 'factor':110C 'fail':104C 'flaw':70C 'found':72C 'host':23B 'ident':18B,83C 'issu':118C 'keycloak':1A,19B,40B,82C 'local':2A,29B,77C 'login':11A,48B,115C 'manag':86C 'mandatori':7A,44B,107C 'may':41B,103C 'multi':109C 'multi-factor':108C 'one':65B,136C 'one-tim':64B,135C 'order':33B,92C 'otp':8A,36B,45B,96C,139C 'packag':20B 'password':54B,67B,125C,138C 'process':116C 'reach':56B 'realm':39B,100C 'requir':3A,30B,63B,78C,134C 'self':22B 'self-host':21B 'set':60B,131C 'skip':6A 'solut':87C 'sso':24B 'system':102C 'time':66B,137C 'updat':27B,75C 'user':28B,76C 'valid':53B,124C 'without':59B,130C","nicknames":[],"mitigations":[],"who_affected":"Realms that require OTP enrollment through required actions and have Update User Locale ordered before Configure OTP are exposed. Realms that do not enforce mandatory OTP enrollment, or that order Configure OTP first, are unlikely to be affected. The sources do not give more detail.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T20:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114438","severity":null,"published_at":"2026-10-21T20:17:26+00:00","modified_at":"2026-10-22T15:25:35+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114438","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114438","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}