{"id":"CVE-2026-118959","title":"Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter","summary":"A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verific…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-287"],"vendor":"Red Hat","product":"keycloak-services","affected":["keycloak-services (all versions)","rhbk/keycloak-rhel9 (all versions)","keycloak-services"],"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T00:15:31.611Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118959","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-118959"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563288","label":"RHBZ#2563288"}],"tags":["cve.org"],"epss":0.00195,"epssPercentile":0.09175,"ingestedAt":"2026-11-03T09:40:52.163Z","slug":"CVE-2026-118959","body":"## Overview\n\nA flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.\n\n## Affected\n\n- `keycloak-services (all versions)`\n- `rhbk/keycloak-rhel9 (all versions)`\n- `keycloak-services`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}