A flaw in the Update User Locale required action of Keycloak allows a user with a valid password to authenticate without enrolling the required one‑time password. When the locale update action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi‑factor authentication enrollment during login, resulting in an authentication bypass that undermines the intended security policy.

Red Hat Build of Keycloak and Red Hat Single Sign‑On 7 are affected. No specific patch or version number is listed in the available data.

The CVSS score of 4.2 suggests moderate severity, and the absence of an EPSS score or KEV listing indicates that exploitation is not yet widespread. However, an attacker who possesses a valid user credential can log in without OTP enrollment, gaining the same access rights as the compromised account. The vulnerability can be abused by any remote attacker who can supply the legitimate password for a target account.