Vulnerability GHSA-4gv3-mc9p-5wqc
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
2 months ago
August 18, 2026 at 06:32 PM UTC
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
26.0.0 - 26.7.1
26.0.0 - 26.7.1
Summary
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
Details
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
1 day ago
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-v3f7-2p4r-mwfw
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-v3f7-2p4r-mwfw
Medium Risk
1 day ago
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-9jrw-8xf7-xqhq
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-9jrw-8xf7-xqhq
Medium Risk
1 day ago
Keycloak allows unauthorized access to resources via uma permission ticket bypass
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-w3p3-7cjg-vgfw
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-w3p3-7cjg-vgfw
High Risk
1 day ago
Keycloak vulnerable to authorization bypass via incorrect uri comparison
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-f5p5-6xmx-p252
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-f5p5-6xmx-p252
Medium Risk
1 day ago
Keycloak: Attacker can re-enable and take over disabled clients via registration access token
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-r7rc-c989-86g6
1.0-alpha-1 and 1.0-alpha-1-12062013 - 1.0-beta-1 and 1.0-beta-1-20150521 and 1.0-beta-1-20150523 - 1.5.0-Final and 1.5.0.Final - 26.6.3 GHSA-r7rc-c989-86g6
Impacted packages
Timeline
Published
2 months ago
August 18, 2026 at 06:32 PM UTC
Fixed (26.7.2)
Unknown
Unknown
Last Modified
2 months ago
August 28, 2026 at 11:10 PM UTC