CVE-2026-114438: Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Order the Configure OTP required action before the Update User Locale required action in the realm to enforce mandatory OTP enrollment during login.
Keycloak required action ordering = Configure OTP before Update User Locale
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Deployments are exposed when the Update User Locale required action is ordered before the Configure OTP required action in a realm and OTP enrollment is intended to be mandatory.
What does an attacker need to exploit the issue?
An attacker needs a valid password for an account subject to the affected required-action ordering. No user interaction is required.
What is the impact of successful exploitation?
The attacker can complete login without enrolling a required OTP credential, bypassing the intended mandatory multi-factor authentication enrollment. The reported impact includes limited confidentiality and integrity effects, with no availability impact.
What can be done before a patch is available?
Review the realm's required-action ordering and avoid placing Update User Locale before Configure OTP where OTP enrollment must be enforced.