A vulnerability in Keycloak's required action provider mechanism allows bypassing mandatory user actions such as profile verification or terms acceptance. When an authorization request includes the kc_action query parameter set to an already assigned mandatory action, Keycloak may incorrectly skip these challenges and issue an authorization code. This flaw requires valid user credentials and affects only specific mandatory actions.