CVE-2026-118959 — Vulnerability intelligence
—
Published:
- CVSS
- 5.4
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.