CVE-2026-3429

CVE-2026-3429 identifies a medium-severity flaw in the Keycloak Account REST API. This vulnerability allows an attacker, who has already obtained a victim's password, to bypass multi-factor authentication by deleting the victim's registered MFA/OTP credential and subsequently registering their own, effectively taking full control of the account. The attack is network-based but requires high complexity due to the prerequisite of knowing the victim's password. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability at this time.