The vulnerability in Red Hat build of Keycloak 26.2 involves improper isolation in the SingleUseObjectProvider component, which is responsible for managing single-use tokens. Due to lack of proper type and namespace isolation, an attacker can delete arbitrary single-use entries, allowing replay attacks on consumed action tokens such as password reset links. This can lead to unauthorized access or account compromise. The issue is tracked as CVE-2026-4325 with a CVSS 3.1 base score of 5.3 (medium severity). Red Hat has issued an important security advisory (RHSA-2026:6475 and RHSA-2026:6476) releasing updated Keycloak packages (26.2.15) that fix this vulnerability. The advisory recommends backing up existing installations before applying the update. The vulnerability affects the standalone Keycloak server and containerized OpenShift images. No exploits are currently known in the wild.

Successful exploitation of this vulnerability allows an attacker to delete arbitrary single-use entries in the SingleUseObjectProvider, enabling replay of consumed action tokens such as password reset links. This can lead to unauthorized access or account compromise. The CVSS score of 5.3 reflects a medium severity impact with high integrity impact but no confidentiality or availability impact. There are no known exploits in the wild at the time of publication.

Red Hat has released updated packages for Red Hat build of Keycloak version 26.2.15 that address this vulnerability. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the official update from Red Hat is the recommended remediation. There is no indication that any temporary workaround or mitigation is available or required beyond applying the update.