CVE-2026-114438: Keycloak Auth Bypass Vulnerability

CVE-2026-114438 Overview

CVE-2026-114438 is an authentication flaw in the Keycloak identity and access management (IAM) solution. The vulnerability resides in the Update User Locale required action. When an administrator orders this action before the Configure OTP required action in a realm, Keycloak may skip enforcement of mandatory multi-factor authentication (MFA) enrollment during login. An attacker who holds a valid password can access the account without configuring the required one-time password (OTP) credential. The weakness is classified under CWE-287: Improper Authentication.

Critical Impact
Attackers with stolen or guessed credentials can access accounts in affected Keycloak realms without completing mandatory OTP enrollment, defeating the MFA control.

Affected Products

Red Hat Keycloak (identity and access management solution)
Red Hat build of Keycloak
Realms configured to require both Update User Locale and Configure OTP required actions

Discovery Timeline

2026-10-21 - CVE-2026-114438 published to the National Vulnerability Database (NVD)
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114438

Vulnerability Analysis

Keycloak uses required actions to enforce workflow steps during authentication, such as updating a profile, changing a password, or enrolling an OTP device. These actions execute in a defined order before the session is fully established. The Update User Locale required action handles the user's language preference. The Configure OTP required action enrolls the second authentication factor.

When Update User Locale is scheduled to run before Configure OTP, the authentication flow fails to carry the pending OTP enrollment requirement through to session completion. The result is a logic error in the required-action pipeline that treats the login as successful without ever presenting the OTP enrollment step. The user becomes authenticated with password-only credentials even though the realm policy mandates OTP.

This is a business logic and authentication flaw rather than a memory safety issue. Exploitation requires valid credentials and a realm configured with the specific action ordering, which raises attack complexity. The impact is limited to the single account whose credentials are compromised, with no direct path to privilege escalation beyond that account's existing permissions.

Root Cause

The root cause is improper state handling in the required-action processor. The Update User Locale action completes and advances the flow in a way that does not preserve the Configure OTP action as still-required. Required-action ordering controls which step the user sees next, and in this ordering the OTP enrollment is effectively skipped.

Attack Vector

The attack is network-based and requires credentials that are already valid for the target account. An attacker obtains a password through phishing, credential stuffing, or prior compromise. The attacker then logs in to the Keycloak realm that is configured with Update User Locale ordered before Configure OTP. Keycloak processes the locale action and issues an authenticated session without prompting for OTP enrollment, bypassing the MFA control.

No verified public proof-of-concept code is available. See the Red Hat CVE-2026-114438 Advisory and Red Hat Bug Report #2558302 for authoritative technical details.

Detection Methods for CVE-2026-114438

Indicators of Compromise

Successful Keycloak login events for accounts flagged as requiring OTP enrollment, where no CONFIGURE_TOTP or UPDATE_TOTP event precedes session establishment.
Authentication sessions that complete immediately after an UPDATE_LOCALE event for users whose realm policy mandates OTP.
Unexpected language preference changes correlated with first-time logins from new IP addresses or user agents.

Detection Strategies

Audit Keycloak realm configurations for any flow where the Update User Locale required action is ordered before Configure OTP.
Query the Keycloak admin event log and user event log for LOGIN events on accounts that still have CONFIGURE_TOTP in their required actions list.
Correlate authentication telemetry with identity provider logs to detect accounts that authenticated with password only despite an MFA mandate.

Monitoring Recommendations

Forward Keycloak event logs to a central SIEM or data lake and alert on logins that complete without an associated OTP challenge for OTP-mandated users.
Monitor for configuration changes to required-action ordering in Keycloak realms and treat such changes as high-signal admin activity.
Track accounts that have CONFIGURE_TOTP pending for longer than policy allows after a successful login.

How to Mitigate CVE-2026-114438

Immediate Actions Required

Review every Keycloak realm and reorder required actions so that Configure OTP executes before Update User Locale.
Identify users who authenticated after the ordering was in place but never completed OTP enrollment, and force OTP setup on next login.
Rotate credentials for any account suspected of logging in without the required MFA enrollment.
Apply the vendor patch when published by Red Hat for the affected Keycloak and Red Hat build of Keycloak versions.

Patch Information

Red Hat tracks the fix under Red Hat Bug Report #2558302 and the Red Hat CVE-2026-114438 Advisory. Administrators should consult these resources for the exact fixed versions and errata as they are released, and update Keycloak and Red Hat build of Keycloak deployments accordingly.

Workarounds

Reorder realm required actions so that Configure OTP precedes Update User Locale, eliminating the vulnerable ordering.
Enforce OTP enrollment out-of-band by requiring administrators to pre-provision OTP credentials for users before first login.
Use conditional authentication flows that explicitly validate OTP presence before granting a session, rather than relying solely on required-action ordering.

bash

# Configuration example: inspect and reorder required actions via kcadm.sh
# List configured required actions and their priorities for a realm
kcadm.sh get authentication/required-actions -r <realm-name>

# Lower priority value = executed earlier. Ensure CONFIGURE_TOTP
# has a lower priority number than UPDATE_USER_LOCALE.
kcadm.sh update authentication/required-actions/CONFIGURE_TOTP \
  -r <realm-name> \
  -s priority=10 \
  -s enabled=true \
  -s defaultAction=true

kcadm.sh update authentication/required-actions/UPDATE_USER_LOCALE \
  -r <realm-name> \
  -s priority=20