CVE-2026-3429: Keycloak Services Improper Access Control Leading to MFA Deletion and Account Takeover
Summary
CVE-2026-3429: A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Affects org.keycloak:keycloak-services versions < 26.5.5. No fix is published. How to fix ↓
Also tracked for
- keycloak · Bitnami
The same CVE-2026-3429 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications and services. It supports various authentication protocols and offers features such as single sign-on (SSO), user federation, and multi-factor authentication (MFA). The vulnerability in question affects the Account REST API of Keycloak, which is responsible for managing user accounts and their associated security credentials.
Vulnerability Detail
A flaw exists in the Account REST API of Keycloak that allows users authenticated at a lower security level to perform sensitive actions meant for higher-assurance sessions. Specifically, an attacker who has obtained a victim's password can delete the victim's registered MFA/OTP credential without proving possession of that factor. This enables the attacker to register their own MFA device, effectively taking full control of the victim's account. This vulnerability undermines the intended protection provided by multi-factor authentication, posing a significant risk to account security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the ability to delete MFA credentials through the Account REST API until the package is updated. This can be done by modifying the security settings in the Keycloak admin console to restrict access to sensitive actions.
Conclusion
The vulnerability CVE-2026-3429 in Keycloak poses a significant risk by allowing unauthorized deletion of MFA credentials, potentially leading to account takeover. It is crucial for users to update to the latest version to mitigate this risk and consider temporary workarounds if immediate updates are not feasible.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
CVE-2026-3429 is a vulnerability in Keycloak that allows unauthorized deletion of multi-factor authentication credentials, leading to potential account takeover.
If exploited, this vulnerability can allow attackers to gain full control of user accounts by deleting MFA credentials without proper authorization.
Consider implementing temporary workarounds, such as disabling MFA credential deletion through the API until you can apply the update.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
