BIT-keycloak-2026-18963

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-18963.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-keycloak-2026-18963
Aliases
Published
2026-08-25T10:46:44Z
Modified
2026-08-28T23:10:21Z
Summary
Flaw in the reset-credentials flow of the keycloak-services component
Details

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*"
    ],
    "severity": "Critical"
}
References

Affected packages

Bitnami / keycloak

Package

Name
keycloak
Purl
pkg:bitnami/keycloak

Severity

  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
26.7.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/keycloak/BIT-keycloak-2026-18963.json"