Bug 2563288 (CVE-2026-118959)

Summary: CVE-2026-118959 keycloak-services: keycloak-services: Required actions bypassed via kc_action parameter
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-29 08:19:22 UTC 
A vulnerability was found in Keycloak where mandatory required actions can be bypassed using the kc_action query parameter. When an authorization request includes kc_action set to the alias of a pending mandatory action (such as VERIFY_PROFILE or TERMS_AND_CONDITIONS), the server incorrectly treats the request as an application-initiated action. Because these specific providers do not support application-initiated invocation, they are added to an internal ignored actions list. Consequently, the authentication flow completes without presenting the required challenge to the user. An authenticated attacker with a pending required action can exploit this by appending the kc_action parameter to their authorization request. Successful exploitation allows the attacker to obtain valid access tokens and bypass admin-enforced requirements like profile attribute updates or acceptance of terms and conditions on every login.