Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the provided patch commit reveals that the core of the vulnerability lies in the default behavior of required actions in Keycloak. The commit message, "Make all required actions one time action by default," directly points to a token replay issue. The vulnerability, as described, allows an attacker to reuse an ExecuteActionsActionToken to take over an account.
The key evidence is the change in server-spi-private/src/main/java/org/keycloak/authentication/RequiredActionFactory.java. The default method isOneTimeAction() in the RequiredActionFactory interface was changed from returning false to true. This single change alters the default security posture for all required actions that do not explicitly override this method. Previously, an action was reusable by default, which created the window for the capture-replay attack mentioned in the CVE. After the patch, all actions are single-use by default, effectively closing this vulnerability.
The other modifications in the commit are consequential changes, such as removing now-redundant overrides of this method in specific action implementations (UpdatePassword, DeleteAccount, etc.) and adding tests to confirm that action links are indeed invalidated after a single use. Therefore, the function org.keycloak.authentication.RequiredActionFactory.isOneTimeAction is identified as the central point of the vulnerability, as its previous default state is the root cause of the security flaw.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.2 | 26.6.2 |
