Keycloak CVE-2026-118959

Exploitation requires an authenticated Keycloak account (PR:L) that already has a mandatory required action assigned to it by an administrator - specifically a required-action/application-initiated-action flow such as profile verification (VERIFY_PROFILE) or terms-and-conditions acceptance. The trigger is an authorization request carrying the kc_action query parameter set to that same already-assigned mandatory action; the required-action provider mechanism then mishandles the application-initiated action and skips the challenge. Limiting factors: the actor must hold valid credentials for the target user, and the account must have a pending mandatory action configured - against a user with no assigned required actions there is nothing to bypass. Impact is confined to circumventing the mandatory-action gate (compliance/onboarding controls), not to privilege escalation beyond that user's own access.

This is a medium-severity authentication/authorization-control bypass (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than a high-urgency flaw. The CVSS vector requires an authenticated user (PR:L) - the actor is a legitimate user bypassing required actions assigned to their own account, not an anonymous attacker, which materially lowers real-world risk. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no evidence of active exploitation. No PoC or exploit reference appears among the references (only the Red Hat CVE page and a Bugzilla tracker). The vuln.today decision label is 'this_month,' consistent with a prioritize-but-not-emergency posture. The signals are internally consistent: network vector but low privileges and low technical impact (C:L/I:L/A:N, no availability impact, unchanged scope). The practical impact is governance/compliance (a user reaching the application without completing mandatory profile verification or accepting terms and conditions) rather than data compromise or code execution. Bottom line: a legitimate but noteworthy access-control defect to patch on a normal cycle, not a drop-everything emergency.

An authenticated Keycloak user who has been assigned a mandatory required action (for example, profile verification or terms-and-conditions acceptance) initiates an authorization request that includes the kc_action query parameter set to that same mandatory action. Due to incorrect handling of application-initiated actions, Keycloak skips the mandatory challenge and issues an authorization code, letting the user reach the application without completing the required step. No public exploit identified at time of analysis; the specific request sequence is derived from the description, and the vector (AV:N/AC:L/PR:L/UI:N) indicates low-complexity, remotely reachable abuse by the account holder.