---
id: CVE-2026-118959
title: >-
  Keycloak-services: keycloak-services: required actions bypassed via kc_action
  parameter
summary: >-
  A flaw was found in the required action provider mechanism of Keycloak. The
  issue occurs when an authorization request includes the kc_action query
  parameter set to a mandatory action already assigned to the user, such as
  profile verific…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-287
vendor: Red Hat
product: keycloak-services
affected:
  - keycloak-services (all versions)
  - rhbk/keycloak-rhel9 (all versions)
  - keycloak-services
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T00:15:31.611Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118959'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-118959'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2563288'
    label: RHBZ#2563288
tags:
  - cve.org
epss: 0.00195
epssPercentile: 0.0926
ingestedAt: '2026-11-03T09:40:52.163Z'
---

## Overview

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.

## Affected

- `keycloak-services (all versions)`
- `rhbk/keycloak-rhel9 (all versions)`
- `keycloak-services`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.