CVE-2026-114438: Improper Authentication in Red Hat Red Hat Build of Keycloak

This vulnerability in Red Hat Build of Keycloak involves improper enforcement of mandatory multi-factor authentication during login. Specifically, if the Update User Locale required action is processed before the Configure OTP action in a realm, the system may fail to require users to enroll in OTP MFA. This allows an attacker who has obtained a valid password to log in without completing the OTP setup, effectively bypassing the intended MFA protection. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impact with no availability impact.

An attacker with a valid password can bypass the mandatory OTP multi-factor authentication requirement, potentially reducing the security of user accounts by allowing access without the second authentication factor. This increases the risk of unauthorized account access if passwords are compromised or guessed. The impact is limited to confidentiality and integrity with low severity and does not affect system availability.

The vendor advisory from Red Hat is available but does not explicitly state patch or remediation status in the provided data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-114438 for current remediation guidance. Until a fix is applied, administrators should review the order of required actions in Keycloak realms and consider additional controls to enforce MFA enrollment.