Threats Tagged 'cve-2026-18963'

A critical security vulnerability (CVE-2026-18963) affects Red Hat build of Keycloak 26.4.15, allowing unauthenticated attackers to take over accounts by bypassing the reset-credentials flow. Red Hat has released updated images and packages for Keycloak 26.4.15 to address this issue. The vulnerability impacts deployments using the Red Hat build of Keycloak for OpenShift Container Platform and standalone installations. Users are advised to back up their installations before applying the update.

Multiple critical security vulnerabilities have been identified in Red Hat build of Keycloak 26.6.6 images used within OpenShift Container Platform. These include privilege escalation via a TOCTOU vulnerability, unauthenticated account takeover, leakage of rotated client secrets, predictable account-linking hashes enabling account takeover, and unauthorized disclosure of hidden group metadata. Red Hat has released updated container images to address these issues for on-premise and private cloud deployments.

Red Hat has issued a critical security update for its build of Keycloak 26.6.6, addressing multiple vulnerabilities including privilege escalation via a TOCTOU flaw, unauthenticated account takeover, information disclosure, and predictable hashes enabling account takeover. The update fixes five CVEs affecting authentication and authorization components. Users are advised to back up their installations before applying the update.

CVE-2026-18963 is a critical vulnerability in the reset-credentials flow of the keycloak-services component in Red Hat build of Keycloak 26.4. This flaw allows an unauthenticated attacker to bypass the required email verification step and directly reset the password of any user, potentially gaining full control over their accounts. The vulnerability affects multiple versions prior to 26.4.15, 26.6.6, and 26.7.2. Red Hat has released security updates to address this issue.

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.