The vulnerability in Keycloak’s Account REST API allows an authenticated user with a lower security level to delete a victim’s registered multi‑factor authentication (MFA) or one‑time‑password (OTP) credentials without proving possession of that factor. After the deletion the attacker can register their own MFA device and take full control of the account, effectively bypassing the intended MFA protection. This flaw represents an improper access control weakness (CWE‑284).

The affected products are Red Hat Build of Keycloak (including builds 26.4 and 26.4.11), Red Hat JBoss Enterprise Application Platform 8 and the Red Hat Single Sign‑On 7 stack. These environments use the Keycloak account REST API and are vulnerable to the described deletion and takeover scenario.

The CVSS score is 4.2, indicating a moderate severity. The EPSS score of less than 1 % suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to already have valid credentials for the victim at a lower security level; once this is achieved, the attacker can delete MFA credentials and register a new device. The attack vector is mediated through the REST API and relies on the existing authenticated session, so widespread exploitation would be limited to environments where these API endpoints are exposed and the attacker has compromised credentials.