{"metadata": {"vulnerability": "CVE-2026-114438", "count": 12, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-10-16T08:27:28Z", "date_only": false, "value": "2026-10-16T08:27:28.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / redhat", "record": "CVE-2026-114438", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-16T08:27:28Z", "date_only": false, "value": "2026-10-16T08:27:28.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / redhat", "record": "CVE-2026-114438", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-21T13:50:56.964Z", "date_only": false, "value": "2026-10-21T13:50:56.964Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-114438", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-21T19:35:37.217Z", "date_only": false, "value": "2026-10-21T19:35:37.217Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-114438", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-21T19:35:37.217Z", "date_only": false, "value": "2026-10-21T19:35:37.217Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-114438", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-21T19:35:37.217Z", "date_only": false, "value": "2026-10-21T19:35:37.217Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / redhat", "record": "CVE-2026-114438", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-21T20:17:26Z", "date_only": false, "value": "2026-10-21T20:17:26Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-52QH-RWJ9-2J89", "record": "GHSA-52QH-RWJ9-2J89", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-21T20:17:26.717Z", "date_only": false, "value": "2026-10-21T20:17:26.717", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114438", "record": "FKIE_CVE-2026-114438", "field": "published"}, {"timestamp": "2026-10-21T20:20:35.394Z", "date_only": false, "value": "2026-10-21T20:20:35.394994Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117480753388393700", "record": "CVE-2026-114438", "field": "creation_timestamp", "uuid": "42f89c19-bfb0-44bc-b6d2-cd7d009e4e41", "content": "CVE-2026-114438 Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is ordered before the Configure OTP action in a realm, the system may fail to enforce mandatory multi-factor authentication enrollment during the login process. This issue allows an attacker with a valid password to access an account without setting up the required one-time password (OTP) credential.\nhttps://www.cve.org/CVERecord?id=CVE-2026-114438https://access.redhat.com/security/cve/CVE-2026-114438https://bugzilla.redhat.com/show_bug.cgi?id=2558302#RedHat #RedHatBuildofKeycloak #RedHatSingleSign-On7#CVE_2026_114438#bot", "url": "https://infosec.exchange/users/cve/statuses/117480753388393700"}, {"timestamp": "2026-10-21T21:32:36Z", "date_only": false, "value": "2026-10-21T21:32:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-52QH-RWJ9-2J89", "record": "GHSA-52QH-RWJ9-2J89", "field": "published"}, {"timestamp": "2026-10-21T21:32:36Z", "date_only": false, "value": "2026-10-21T21:32:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-52QH-RWJ9-2J89", "record": "GHSA-52QH-RWJ9-2J89", "field": "modified"}, {"timestamp": "2026-10-22T15:25:35.333Z", "date_only": false, "value": "2026-10-22T15:25:35.333", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-114438", "record": "FKIE_CVE-2026-114438", "field": "lastModified"}]}