CVE-2026-3429: 
Java vulnerability analysis and mitigation

CVE-2026-3429 is an Improper Access Control vulnerability in the Account REST API of Keycloak (CWE-284) that allows an attacker who has obtained a victim's username and password to delete the victim's registered MFA/OTP credential without completing step-up authentication, then register their own MFA device to achieve full account takeover. The flaw was reported on March 2, 2026, and published to NVD on March 11, 2026. It affects Keycloak and Red Hat build of Keycloak (confirmed fixed in versions 26.4.11 and 26.5.7). The CVSS v3.1 base score is 4.2 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is insufficient validation of the authentication Level of Assurance (LoA) within the org.keycloak.services.resources.account component before permitting credential management actions (CWE-284). Keycloak supports step-up authentication, where higher-assurance sessions are required for sensitive operations; however, the Account REST API fails to enforce this requirement for MFA credential deletion. An attacker authenticated at a lower LoA (i.e., with only a password) can issue API requests to delete a victim's OTP/MFA credential and subsequently enroll their own authenticator device. Exploitation requires network access and valid primary credentials (username and password) for the target account, but no user interaction or elevated privileges beyond a standard authenticated session (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation results in full account takeover: the attacker removes the victim's MFA factor and registers their own, locking the legitimate user out of their second factor and granting the attacker persistent authenticated access. This compromises both account integrity and partial confidentiality, as the attacker gains access to all resources and applications protected by the Keycloak identity provider. Availability is not directly impacted, but the victim loses effective control of their account and any downstream services relying on Keycloak for authentication (Red Hat Bugzilla, Red Hat CVE).

1. Obtain victim credentials: Acquire the target user's Keycloak username and password through phishing, credential stuffing, or other means — MFA knowledge is not required.
2. Authenticate at lower LoA: Use the stolen credentials to authenticate to Keycloak via the standard password flow, obtaining an access token without completing MFA step-up authentication.
3. Identify the victim's MFA credential: Query the Keycloak Account REST API (e.g., GET /realms/{realm}/account/credentials) using the obtained access token to enumerate the victim's registered OTP/MFA credential IDs.
4. Delete the victim's MFA credential: Issue a DELETE /realms/{realm}/account/credentials/{credentialId} API request with the lower-LoA access token. Due to the missing LoA enforcement, the server accepts the request and removes the victim's MFA factor.
5. Register attacker's own MFA device: Enroll a new OTP/MFA device under the victim's account via the Account REST API, completing the account takeover.
6. Achieve persistent access: With the attacker's MFA device registered, log in as the victim using the known password and the newly registered MFA factor, gaining full authenticated access to all protected resources (Red Hat Bugzilla).

• Logs: Keycloak audit/event logs showing a DELETE_CREDENTIAL event for an OTP/MFA credential type followed immediately by a CREATE_CREDENTIAL event from a different IP address or user agent for the same account.
• Logs: Authentication events showing a user session authenticated at a lower Level of Assurance (LoA) performing credential management actions that should require step-up authentication.
• Network: Unexpected API calls to /realms/{realm}/account/credentials/{credentialId} using DELETE method from unfamiliar IP addresses or clients.
• Logs: A user account losing MFA enrollment followed by re-enrollment from a different device fingerprint or location within a short time window.
• Logs: Subsequent successful logins from new geographic locations or devices shortly after MFA credential changes (Red Hat Bugzilla).

Red Hat has released patches addressing CVE-2026-3429 in Red Hat build of Keycloak 26.4.11 (RHSA-2026:6477 for packages, RHSA-2026:6478 for container images, both issued April 2, 2026) and in upstream Keycloak 26.5.7. Organizations should upgrade to these versions as the primary remediation. As a temporary workaround, administrators can restrict access to the Account REST API credential management endpoints or enforce stricter session policies requiring step-up authentication before any credential modification. Backing up existing configurations before applying updates is recommended (RHSA-2026:6477, RHSA-2026:6478, Keycloak Release).

The vulnerability was noted in the Keycloak 26.5.7 release announcement and covered in the Red Hat security errata. INCIBE-CERT (Spain's national cybersecurity agency) published an early warning advisory. The ISC SANS Internet Stormcast podcast referenced the vulnerability in its coverage. Community discussion was limited, consistent with the medium severity rating and the precondition of requiring prior credential compromise (Keycloak Blog, INCIBE).