Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el7 | rh-sso7-keycloak | 0:18.0.21-1.redhat_00001.1.el7sso |
| Red Hat · Red Hat Single Sign On 7 red_hat_single_sign_on:7.6::el7 | rh-sso7-keycloak-server | 0:18.0.21-1.redhat_00001.1.el7sso |
Vulnerabilities 1
-
Critical 9.1
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for a…
References
-
article
https://access.redhat.com/security/updates/classification/#critical
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99764.json
-
report
https://access.redhat.com/security/cve/CVE-2026-18963
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2511595
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-18963
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-18963