GHSA-4gv3-mc9p-5wqc

Source

https://github.com/advisories/GHSA-4gv3-mc9p-5wqc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-4gv3-mc9p-5wqc/GHSA-4gv3-mc9p-5wqc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4gv3-mc9p-5wqc

Aliases

BIT-keycloak-2026-18963
CVE-2026-18963

Downstream

CGA (16)

MINI (2)

Published

2026-08-18T18:32:00Z

Modified

2026-08-28T23:10:21Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

Details

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Database specific

{
    "cwe_ids":  [
        "CWE-640"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-28T22:53:41Z",
    "nvd_published_at":  "2026-08-18T17:16:57Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Maven / org.keycloak:keycloak-services

Package

Name: org.keycloak:keycloak-services; View open source insights on deps.dev
Purl: pkg:maven/org.keycloak/keycloak-services

Affected ranges

Type: ECOSYSTEM
Events: Introduced

26.0.0

Fixed

26.4.15

Affected versions

26.*

26.0.0

26.0.1

26.0.2

26.0.3

26.0.4

26.0.5

26.0.6

26.0.7

26.0.8

26.1.0

26.1.1

26.1.2

26.1.3

26.1.4

26.1.5

26.2.0

26.2.1

26.2.2

26.2.3

26.2.4

26.2.5

26.3.0

26.3.1

26.3.2

26.3.3

26.3.4

26.3.5

26.4.0

26.4.1

26.4.2

26.4.3

26.4.4

26.4.5

26.4.6

26.4.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-4gv3-mc9p-5wqc/GHSA-4gv3-mc9p-5wqc.json"

Maven / org.keycloak:keycloak-services

Package

Name: org.keycloak:keycloak-services; View open source insights on deps.dev
Purl: pkg:maven/org.keycloak/keycloak-services

Affected ranges

Type: ECOSYSTEM
Events: Introduced

26.5.0

Fixed

26.6.6

Affected versions

26.*

26.5.0

26.5.1

26.5.2

26.5.3

26.5.4

26.5.5

26.5.6

26.5.7

26.6.0

26.6.1

26.6.2

26.6.3

26.6.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-4gv3-mc9p-5wqc/GHSA-4gv3-mc9p-5wqc.json"

Maven / org.keycloak:keycloak-services

Package

Name: org.keycloak:keycloak-services; View open source insights on deps.dev
Purl: pkg:maven/org.keycloak/keycloak-services

Affected ranges

Type: ECOSYSTEM
Events: Introduced

26.7.0

Fixed

26.7.2

Affected versions

26.*

26.7.0

26.7.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-4gv3-mc9p-5wqc/GHSA-4gv3-mc9p-5wqc.json"