9.1
Critical
CVE-2026-18963 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity…
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat build of Keycloak 26.6.6 | Versions not published | |
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-23 | 26.4-23 |
| Red Hat build of Keycloak 26.6 26.6 | earliest → < 26.6-12 | 26.6-12 |
| Red Hat build of Keycloak 26.4.15 | Versions not published | |
| Industrial Edge Management Cloud | Versions not published | |
| Industrial Edge Management Pro V1 1.14 | 1.14.9 → < 1.15.20 | 1.15.20 |
Show the 2 other branches Hide the 2 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Industrial Edge Management Pro V2 2.2 | 2.2.0 → < 2.2.2 | 2.2.2 |
| Industrial Edge Management Virtual 2.6 | 2.6.0 → < 2.9.1 | 2.9.1 |
References
- RHSA-2026:56519 access.redhat.com
- RHSA-2026:56520 access.redhat.com
- RHSA-2026:56523 access.redhat.com
- RHSA-2026:56524 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2511595 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Build of Keycloak
The 276 CVEs of Red Hat Build of Keycloak →
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
6.5
Medium
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Medium
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Medium
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Medium