A vulnerability was found in Keycloak where mandatory required actions can be bypassed using the kc_action query parameter. When an authorization request includes kc_action set to the alias of a pending mandatory action (such as VERIFY_PROFILE or TERMS_AND_CONDITIONS), the server incorrectly treats the request as an application-initiated action. Because these specific providers do not support application-initiated invocation, they are added to an internal ignored actions list. Consequently, the authentication flow completes without presenting the required challenge to the user. An authenticated attacker with a pending required action can exploit this by appending the kc_action parameter to their authorization request. Successful exploitation allows the attacker to obtain valid access tokens and bypass admin-enforced requirements like profile attribute updates or acceptance of terms and conditions on every login.