CVE-2026-118959

CVE-2026-118959 · Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.

CVSS 5.4 · Средний · EPSS 0,2%

Опубликовано

2026-10-30T00:15:31.611Z

Обновлено

2026-11-03T17:09:23.888Z

Проверьте свой сервер →