9.1
Critique
CVE-2026-18963 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity…
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions non publiées | |
| Red Hat Single Sign-On 7 | Versions non publiées | |
| Red Hat build of Keycloak 26.6.6 | Versions non publiées | |
| Red Hat build of Keycloak 26.4 26.4 | premières → < 26.4-23 | 26.4-23 |
| Red Hat build of Keycloak 26.6 26.6 | premières → < 26.6-12 | 26.6-12 |
| Red Hat build of Keycloak 26.4.15 | Versions non publiées | |
| Industrial Edge Management Cloud | Versions non publiées | |
| Industrial Edge Management Pro V1 1.14 | 1.14.9 → < 1.15.20 | 1.15.20 |
Afficher les 2 autres branches Masquer les 2 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Industrial Edge Management Pro V2 2.2 | 2.2.0 → < 2.2.2 | 2.2.2 |
| Industrial Edge Management Virtual 2.6 | 2.6.0 → < 2.9.1 | 2.9.1 |
Autres CVE de Red Hat Build of Keycloak
Les 277 CVE de Red Hat Build of Keycloak →
CVE-2026-120984
Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import
9.1
Critique
CVE-2026-9797
Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
6.5
Moyenne
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Moyenne
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Moyenne