This vulnerability exists in the reset-credentials flow of the keycloak-services component, which is the core identity and access management engine in Red Hat build of Keycloak. The flaw allows an unauthenticated remote attacker to force the password reset process for any user without clicking the required email verification link. The root cause is improper state validation in the reset-credentials authentication flow. Exploitation results in the attacker gaining full access to target user accounts by directly setting new credentials. The vulnerability has a CVSS v3.1 base score of 9.1 (critical) with network attack vector, low complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. Red Hat has published a security advisory and released a fixed version 26.6.6 that addresses this issue.

An unauthenticated attacker can bypass the email verification step in the password reset process and reset passwords for any user account. This leads to complete account takeover, compromising confidentiality and integrity of user accounts. There is no impact on availability. The vulnerability allows full control over user identities without requiring any authentication or user interaction.

Red Hat recommends upgrading to the fixed version 26.6.6 of Red Hat build of Keycloak as soon as possible. As a temporary mitigation, if immediate upgrade is not feasible, administrators can disable the "Forgot password" functionality across all realms via the administration console (Realm settings → Login → Forgot password → Off). This prevents exploitation by blocking the vulnerable password reset flow until a patch can be applied.