REDHAT-BUG-2563288: Medium severity vulnerability
A vulnerability was found in Keycloak where mandatory required actions can be bypassed using the kcaction query parameter. When an authorization request includes kcaction set to the alias of a pending mandatory action (such as VERIFYPROFILE or TERMSANDCONDITIONS), the server incorrectly treats the request as an application-initiated action. Because these specific providers do not support application-initiated invocation, they are added to an internal ignored actions list. Consequently, the authentication flow completes without presenting the required challenge to the user. An authenticated attacker with a pending required action can exploit this by appending the kcaction parameter to their authorization request. Successful exploitation allows the attacker to obtain valid access tokens and bypass admin-enforced requirements like profile attribute updates or acceptance of terms and conditions on every login.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated and have a pending mandatory required action. They exploit it by adding a kc_action query parameter set to the alias of that pending action to an authorization request.
Which required actions are affected?
The issue affects pending mandatory actions whose providers do not support application-initiated invocation. The provided examples are VERIFY_PROFILE and TERMS_AND_CONDITIONS.
What is the impact of a successful bypass?
The attacker can complete the authentication flow and obtain valid access tokens without completing the required challenge. This can bypass administrator-enforced requirements such as updating profile attributes or accepting terms and conditions at login.