Flaw in Keycloak Identity and Access Management Solution

CVE-2026-114438

What is CVE-2026-114438?

A critical flaw exists in the Update User Locale required action within Keycloak, an identity and access management solution. If an action to update user locale is executed before configuring the one-time password (OTP) action in a realm, the system may fail to enforce necessary multi-factor authentication enrollment. This allows an attacker with valid credentials to bypass the security measure and gain unauthorized access without completing the OTP setup, significantly increasing the risk of account compromise.

References