Live › vulnerability › CVE-2026-118959
A crafted authorization request with the kc_action parameter can make Keycloak skip required steps such as profile verification or terms acceptance and issue an authorization code. An attacker who has a valid account can reach the application without completing those mandatory steps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 01:27 UTC. All times on this page are UTC.
Organizations running Keycloak as an identity provider that enforce required actions such as profile verification or terms acceptance before granting application access. The flaw lets a user with valid credentials bypass those checks, so deployments that do not use required actions are less exposed. unknown for which exact versions are affected.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.
This page as .md · .json · in your agent: get_signal("CVE-2026-118959")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.