---
id: CVE-2026-114438
title: >-
  Keycloak-services: keycloak-services: required otp enrollment bypassed via
  update user locale required action ordering
summary: >-
  A flaw was found in the Update User Locale required action of the Keycloak
  identity and access management solution. When this action is ordered before
  the Configure OTP action in a realm, the system may fail to enforce mandatory
  multi-fa…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-287
vendor: Red Hat
product: keycloak-services
affected:
  - keycloak-services (all versions)
  - rhbk/keycloak-rhel9 (all versions)
  - keycloak-services (all versions)
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T19:35:37.217Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114438'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-114438'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2558302'
    label: RHBZ#2558302
tags:
  - cve.org
ingestedAt: '2026-10-21T20:11:44.906Z'
---

## Overview

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.

## Affected

- `keycloak-services (all versions)`
- `rhbk/keycloak-rhel9 (all versions)`
- `keycloak-services (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.