Is CVE-2026-118959 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118959 being exploited in the wild.

How severe is CVE-2026-118959?

Medium severity, with a CVSS score of 5.4, published 30 October 2026.

Is there a fix for CVE-2026-118959?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-118959 attacked?

It is attacked over the network.

Am I affected by CVE-2026-118959?

Check whether you run Red Hat Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118959: Keycloak required action provider authentication bypass

CVE-2026-118959 · Severity: medium · CVSS 5.4 · Published 2026-10-30

Keycloak is an identity and access management system that enforces mandatory user actions such as profile verification and terms acceptance before granting access to applications. A flaw in how Keycloak handles the kc_action parameter allows authenticated users to bypass these mandatory challenges and obtain authorization codes without completing required profile updates or agreeing to terms. An attacker with valid credentials can circumvent administrative access control requirements.

Technologies: Red Hat Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-118959 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118959 being exploited in the wild.
How severe is CVE-2026-118959?: Medium severity, with a CVSS score of 5.4, published 30 October 2026.
Which products and versions are affected?: Red Hat Keycloak.
Is there a fix for CVE-2026-118959?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-118959 attacked?: It is attacked over the network.
Am I affected by CVE-2026-118959?: Check whether you run Red Hat Keycloak. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Keycloak's required action provider mechanism where the kc_action query parameter is improperly handled, causing mandatory actions to be incorrectly categorized as unsupported application-initiated actions and subsequently ignored (CWE-287: Improper Authentication). Attack requires network access, valid user credentials (Low privilege), and no user interaction. Successful exploitation allows attackers to bypass profile verification and terms-of-service acceptance to obtain active sessions.

Affected products

Red Hat Keycloak

Timeline

2026-10-30: disclosed
other: Red Hat assessment: requires valid credentials, affects specific mandatory actions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.