{"id":"CVE-2026-114438","title":"Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering","summary":"A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-fa…","severity":"medium","cvss":4.2,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-287"],"vendor":"Red Hat","product":"keycloak-services","affected":["keycloak-services (all versions)","rhbk/keycloak-rhel9 (all versions)","keycloak-services (all versions)"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T19:35:37.217Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114438","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-114438"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2558302","label":"RHBZ#2558302"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T20:11:44.906Z","slug":"CVE-2026-114438","body":"## Overview\n\nA flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.\n\n## Affected\n\n- `keycloak-services (all versions)`\n- `rhbk/keycloak-rhel9 (all versions)`\n- `keycloak-services (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nMitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":23.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}