Executive brief
Keycloak is an open-source identity and access management system used by organizations to manage user authentication and authorization across applications. This vulnerability allows an attacker to take over any user account without authentication by bypassing the email verification step in the password reset flow, gaining complete control over the target account and all associated resources.
Technical details
The vulnerability exists in the keycloak-services component, the core identity and access management engine in Keycloak. The reset-credentials flow fails to properly enforce email verification, allowing an unauthenticated attacker to initiate and complete a password reset for any user without clicking the required verification link. This is a weak password recovery mechanism (CWE-640). The attack requires only network access and no authentication or user interaction. An attacker can exploit this to directly set new credentials for any target account, gaining full account control. Patches have been released: version 26.4.15, 26.6.6, and 26.7.2 address the vulnerability in their respective version branches.
Affected products
- Red Hat Keycloak >= 26.0.0, < 26.4.15; >= 26.5.0, < 26.6.6; >= 26.7.0, < 26.7.2
Timeline
- 2026-08-18: disclosed: Advisory published
- 2026-08-18: patched: Patches released in versions 26.4.15, 26.6.6, and 26.7.2