{"id":"CVE-2026-118959","state":"PUBLISHED","title":"Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter","description":"A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.","publishedAt":"2026-10-30T00:15:31.611Z","updatedAt":"2026-10-30T00:15:31.611Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Build of Keycloak","Red Hat Red Hat Single Sign-On 7"],"affected":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak-services","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"keycloak-services","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}],"references":["https://access.redhat.com/security/cve/CVE-2026-118959","https://bugzilla.redhat.com/show_bug.cgi?id=2563288"],"weaknesses":["CWE-287"],"ingestedAt":"2026-10-30T00:42:06.548Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/118xxx/CVE-2026-118959.json","commit":"f2d9c0cd2d318104f2c83e3c222afbb3de255dfb","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-118959","state":"PUBLISHED","datePublished":"2026-10-30T00:15:31.611Z","dateUpdated":"2026-10-30T00:15:31.611Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-10-29T08:18:57.879Z"},"containers":{"cna":{"title":"Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter","descriptions":[{"lang":"en","value":"A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"keycloak-services","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"rhbk/keycloak-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"keycloak-services","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-118959","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563288","name":"RHBZ#2563288","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","description":"Improper Authentication","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-30T00:15:31.611Z"},"datePublic":"2026-10-28T14:45:28.000Z","x_redhatCweChain":"CWE-287: Improper Authentication","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"timeline":[{"lang":"en","time":"2026-10-28T14:45:28.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-10-28T14:45:28.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Edgar Fyodorov for reporting this issue."}],"x_generator":{"engine":"cvelib 1.8.0"}}}}}