Sign in
Deutsch English Español Polski
Critical

Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

  • Disclosed: 18.08.2026
  • Updated: 11.10.2026 13:19

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.keycloak:keycloak-services >= 26.0.0, < 26.4.15, >= 26.5.0, < 26.6.6, >= 26.7.0, < 26.7.2 26.4.15, 26.6.6, 26.7.2

References

CVSS score 9.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE)
CWE-640
Platform
Java / Kotlin (Maven)
Package
org.keycloak:keycloak-services
Disclosed
18.08.2026
Updated
11.10.2026 13:19

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4gv3-mc9p-5wqc - CC BY 4.0

Vulnerability history: org.keycloak:keycloak-services

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (98) in the archive
Total entries
98
First → latest
01.2022 08.2026
Without a fix
16
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 26
  • Medium 51
  • Low 18

Disclosures per year

Severity:
  1. Keycloak: Unauthenticated account takeover via reset-credentials flow bypass this entry
    Critical · 9.1 CVE-2026-18963 >= 26.0.0, < 26.4.15, >= 26.5.0, < 26.6.6, >= 26.7.0, < 26.7.2 26.4.15, 26.6.6, 26.7.2
  2. Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
    High · 7.7 CVE-2026-2092 <= 26.2.5, >= 26.3.0, <= 26.4.7, >= 26.5.0 no fix
  3. Keycloak has privilege escalation via improper scope mapping enforcement
    High · 7.3 CVE-2026-9795 < 26.6.4 26.6.4
  4. Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
    High · 8.1 CVE-2026-7504 < 26.6.2 26.6.2
  5. Keycloak: Session fixation in OIDC login flow that can lead to account takeover
    High · 7.5 CVE-2026-7507 < 26.6.2 26.6.2
  6. Keycloak: Access token disclosure and implicit flow bypass via forged client data
    High · 7.1 CVE-2026-7571 < 26.6.2 26.6.2
  7. Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
    High · 7.4 CVE-2026-4282 < 26.5.7 26.5.7
  8. Keycloak: Application-Level DoS via Scope Processing
    High · 7.5 CVE-2026-4634 < 26.5.7 26.5.7
  9. Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
    High · 8.1 CVE-2026-4636 < 26.5.7 26.5.7
  10. Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
    High · 7.3 CVE-2026-3872 < 26.5.7 26.5.7
  11. Keycloak: Unauthorized authentication via disabled SAML Identity Provider
    High · 8.1 CVE-2026-2603 < 26.5.5 26.5.5
  12. Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
    High · 8.1 CVE-2026-3009 < 26.5.5 26.5.5
  13. Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
    High · 8.8 CVE-2026-1486 >= 26.5.0, < 26.5.3, < 26.4.9 26.5.3, 26.4.9
  14. Keycloak affected by improper invitation token validation
    High · 8.1 CVE-2026-1529 >= 26.5.0, < 26.5.3, < 26.2.13, >= 26.3.0, < 26.4.9 26.5.3, 26.2.13, 26.4.9
  15. Keycloak hostname verification
    High · 8.2 CVE-2025-3501 < 26.2.2 26.2.2
  16. org.keycloak:keycloak-services has Inefficient Regular Expression Complexity
    High · 6.5 CVE-2024-10270 < 24.0.9, >= 25.0.0, < 26.0.6 24.0.9, 26.0.6
  17. Keycloak has session fixation in Elytron SAML adapters
    High · 7.1 CVE-2024-7341 < 22.0.12, >= 23.0.0, < 24.0.7, >= 25.0.0, < 25.0.5 22.0.12, 24.0.7, 25.0.5
  18. Keycloak's admin API allows low privilege users to use administrative functions
    High · 8.1 CVE-2024-3656 < 24.0.5 24.0.5
  19. Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
    High · 7.5 CVE-2024-4540 < 24.0.5 24.0.5
  20. Keycloak path traversal vulnerability in redirection validation
    High · 8.1 CVE-2024-1132 < 22.0.10, >= 23.0.0, < 24.0.3 22.0.10, 24.0.3
Show more (9) Showing 20 of 29

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.