PT-2026-24745 · Red Hat+1 · Red Hat Build Of Keycloak+6

Osidb Bzimport

·

Published

2026-03-11

·

Updated

2026-04-06

·

CVE-2026-3429

CVSS v3.1

4.2

Medium

VectorAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)
Description A flaw exists in the Account REST API of Keycloak that allows a user authenticated with a lower security level to perform sensitive actions intended only for higher-assurance sessions. An attacker who has obtained a victim’s password can delete the victim’s registered MFA/OTP credential without proving possession of that factor. The attacker can then register their own MFA device, gaining full control of the account. This undermines the protection provided by multi-factor authentication. The API endpoint involved is the Account REST API. The vulnerable action involves deleting MFA/OTP credentials.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-3429
GHSA-8G9R-9WJW-37J4

Affected Products

Red Hat Build Of Keycloak
Red Hat Enterprise Application Platform 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Red Hat Single Sign-On 7
Red Hat Build Of Keycloak 26.4
Red Hat Build Of Keycloak 26.4.11
Org.Keycloak:Keycloak-Services