Vulnerability · Published Oct 21, 2026 · Assigned by redhat

CVE-2026-114438Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering

Medium 4.2

In plain English

A medium-severity improper authentication in Red Hat Build of Keycloak from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 94.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Build of Keycloak	see references
Red Hat	Red Hat Single Sign-On 7	see references

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-114438 vdb-entry, x_refsource_REDHAT
RHBZ#2558302 issue-tracking, x_refsource_REDHAT