Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering
Impact
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.
Source excerpt · redhatWhat to do
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Red Hat · Red Hat Build of Keycloak
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Build of Keycloak
Other versions: affected
| Version / range | Source status |
|---|
Red Hat · Red Hat Single Sign-On 7
Other versions: affected
| Version / range | Source status |
|---|
Original source description
A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.