Keycloak CVE-2026-114438

Exploitation requires a realm specifically configured so the 'Update User Locale' required action is ordered BEFORE the 'Configure OTP' required action, with mandatory OTP enrollment expected - this is a non-default administrative ordering, not an out-of-the-box state. The attacker must already possess valid password credentials for the target account (PR:L); the flaw does not grant credential theft, only the ability to skip the OTP enrollment gate. Limiting factors: the specific required-action ordering must exist, mandatory MFA must be in use, and valid password knowledge is a precondition, all of which substantially narrow real-world exploitability.

This is a genuinely low-priority issue despite being an authentication-bypass class (CWE-287) weakness. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2 MEDIUM) is internally consistent with the description: network-reachable but high complexity because exploitation depends on a specific, non-default ordering of realm required actions, and PR:L because the attacker must already hold a valid account password. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The signals do not conflict: a low CVSS, a misconfiguration prerequisite, and the need for a valid password all point the same direction - a real but situational hardening gap rather than a widespread or urgently exploitable flaw. The main nuance is that the 'impact' is a security-control bypass (MFA enrollment is skipped), which the CVSS only partially captures as C:L/I:L; the downstream risk depends heavily on how much the organization relies on that OTP step as a compensating control.

In a Keycloak/Red Hat SSO realm where the 'Update User Locale' required action is ordered before 'Configure OTP', an attacker who already knows a valid username and password logs in and is served the locale step first, after which the session completes without ever forcing OTP enrollment. The attacker thereby reaches the account with only the password, defeating the organization's mandatory multi-factor requirement. No public exploit code was identified in the provided data.