CVE-2026-118959

A flaw exists in the required action provider mechanism of Keycloak . The vulnerability occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user (e.g., profile verification or terms and conditions). Due to incorrect handlin...