CVE-2026-114438

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Update User Locale required action. If this action is sequenced before the Configure OTP action within a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during login. This allows an attacker possessing a valid password to access an account without configuring the required one-time password (OTP) credential.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.