9.1
Critical
CVE-2026-18963 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity…
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat build of Keycloak 26.6.6 | Versions not published | |
| Red Hat build of Keycloak 26.4 26.4 | earliest → < 26.4-23 | 26.4-23 |
| Red Hat build of Keycloak 26.6 26.6 | earliest → < 26.6-12 | 26.6-12 |
| Red Hat build of Keycloak 26.4.15 | Versions not published | |
| Industrial Edge Management Cloud | Versions not published | |
| Industrial Edge Management Pro V1 1.14 | 1.14.9 → < 1.15.20 | 1.15.20 |
Show the 2 other branches Hide the 2 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Industrial Edge Management Pro V2 2.2 | 2.2.0 → < 2.2.2 | 2.2.2 |
| Industrial Edge Management Virtual 2.6 | 2.6.0 → < 2.9.1 | 2.9.1 |
Other CVEs of Red Hat Build of Keycloak
The 277 CVEs of Red Hat Build of Keycloak →
CVE-2026-120984
Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import
9.1
Critical
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
6.5
Medium
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Medium
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Medium