This vulnerability affects the reset-credentials flow of the keycloak-services component in Red Hat Build of Keycloak, which manages identity and access. An unauthenticated remote attacker can exploit improper state validation to bypass the email verification link normally required in the password reset process. This enables the attacker to forcibly reset passwords for any user account without interaction, resulting in full account takeover. The issue is classified under CWE-640 (Weak Password Recovery Mechanism). Red Hat has assigned a CVSS v3.1 score of 9.1 (critical) reflecting network attack vector, no privileges or user interaction required, and high confidentiality and integrity impact. The vendor advisory states no mitigation or fix currently meets their criteria for ease of use, applicability, or stability.

An unauthenticated attacker can gain full control over any user account by bypassing the email verification step in the password reset process. This compromises confidentiality and integrity of user accounts, allowing unauthorized access and credential changes. Availability is not impacted. The vulnerability can be exploited remotely without any user interaction or privileges.

Currently, Red Hat has not provided an official fix or mitigation that meets their criteria for deployment and stability. Users should monitor the Red Hat advisory for updates on patches or mitigations. Until a fix is available, consider restricting access to the password reset functionality or implementing additional controls if feasible. Avoid relying on partial or unofficial mitigations that may not fully address the issue.