Vulnerability-Lookup

CVE-2026-18963 (GCVE-0-2026-18963)

Vulnerability from cvelistv5 – Published: 2026-08-18 17:05 – Updated: 2026-09-08 08:44

Previdian

Title

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

Summary

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 13:53 UTC

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

redhat redhat root

References

7 references

URL	Tags
https://access.redhat.com/errata/RHSA-2026:56519	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56523	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56524	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-18963	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2511595	issue-trackingx_refsource_REDHAT
https://cert-portal.siemens.com/productcert/html/…

Impacted products

12 products

Vendor	Product	Version	CPE status
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4.15-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4	Unaffected: 26.4-23 , < * (rpm) cpe:/a:redhat:build_keycloak:26.4::el9
Red Hat	Red Hat build of Keycloak 26.4.15	cpe:/a:redhat:build_keycloak:26.4
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6.6-1 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6	Unaffected: 26.6-12 , < * (rpm) cpe:/a:redhat:build_keycloak:26.6::el9
Red Hat	Red Hat build of Keycloak 26.6.6	cpe:/a:redhat:build_keycloak:26.6
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7
Siemens	Industrial Edge Management Cloud	Affected: 0 , < * (custom)	guessed
Siemens	Industrial Edge Management Pro V1	Affected: V1.14.9 , < V1.15.20 (custom)	guessed
Siemens	Industrial Edge Management Pro V2	Affected: V2.2.0 , < V2.2.2 (custom)	guessed
Siemens	Industrial Edge Management Virtual	Affected: V2.6.0 , < V2.9.1 (custom)	guessed

Date Public

2026-08-17 00:00

Credits

Red Hat would like to thank James Paremain for reporting this issue.

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: ac24fb5c-fbc7-4c87-9137-bb60608b01e0

Vulnerability ID: CVE-2026-18963

Status: Confirmed

Status Updated: 2026-08-25 15:13 UTC

Exploited: Yes

Timestamps

First Seen: 2026-08-25

Asserted: 2026-08-25

Scope

Notes: Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass | Affected: Red Hat / Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.6, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7 | CVSS: 9.1 (CRITICAL) | EPSS: 0.02788 | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
Vendor	Red Hat
Product	Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.15, Red Hat build of Keycloak 26.6, Red Hat build of Keycloak 26.6.6, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7
Added Date	2026-08-25T15:13:17.550Z
Cvss Score	9.1
Epss Score	0.02788
Cvss Severity	CRITICAL
Epss Percentile	0.85319
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-08-26 16:00 UTC | Updated: 2026-08-26 16:00 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18963",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:53:38.227092Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T13:53:45.840Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Cloud",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Pro V1",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V1.15.20",
                "status": "affected",
                "version": "V1.14.9",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Pro V2",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.2.2",
                "status": "affected",
                "version": "V2.2.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "Industrial Edge Management Virtual",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.9.1",
                "status": "affected",
                "version": "V2.6.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:44:23.776Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-503852.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4.15-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-23",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.4-23",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat build of Keycloak 26.4.15",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
          "product": "Red Hat build of Keycloak 26.4.15",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-operator-bundle",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6.6-1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbk/keycloak-rhel9-operator",
          "product": "Red Hat build of Keycloak 26.6",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "26.6-12",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-keycloak-rhel9/rhbk-keycloak-rhel9",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:build_keycloak:26.6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
          "product": "Red Hat build of Keycloak 26.6.6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "cpes": [
            "cpe:/a:redhat:jbosseapxp"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:red_hat_single_sign_on:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "keycloak-services",
          "product": "Red Hat Single Sign-On 7",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank James Paremain for reporting this issue."
        }
      ],
      "datePublic": "2026-08-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Critical"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T22:25:58.686Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2026:56519",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56519"
        },
        {
          "name": "RHSA-2026:56520",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56520"
        },
        {
          "name": "RHSA-2026:56523",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56523"
        },
        {
          "name": "RHSA-2026:56524",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:56524"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-18963"
        },
        {
          "name": "RHBZ#2511595",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511595"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-31T15:46:15.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-08-17T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass",
      "workarounds": [
        {
          "lang": "en",
          "value": "If an immediate upgrade is not possible, disabling the \"Forgot password\" functionality across all realms can be used as a temporary mitigation.\n\nIn the RHBK administration console, navigate to:\n\nRealm settings \u2192 Login \u2192 Forgot password \u2192 Off\n\nApply this setting to all realms.\n\nUpgrade to a fixed version as soon as possible."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-18963",
    "datePublished": "2026-08-18T17:05:07.478Z",
    "dateReserved": "2026-08-05T15:00:40.360Z",
    "dateUpdated": "2026-09-08T08:44:23.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-18963",
      "date": "2026-09-12",
      "epss": "0.03177",
      "percentile": "0.87317"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-18963\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-08-18T17:16:57.083\",\"lastModified\":\"2026-09-08T09:17:43.063\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4::el9\"],\"versions\":[{\"version\":\"26.4.15-1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4::el9\"],\"versions\":[{\"version\":\"26.4-23\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4::el9\"],\"versions\":[{\"version\":\"26.4-23\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4.15\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"keycloak-services\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.4.15\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-openshift-rhel9/rhbk-openshift-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6.6-1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6-12\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhbk/keycloak-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6::el9\"],\"versions\":[{\"version\":\"26.6-12\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"keycloak-services\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-keycloak-rhel9/rhbk-keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Keycloak 26.6.6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-openshift-rhel9/rhbk-openshift-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:26.6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\"packageName\":\"keycloak-services\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"keycloak-services\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Cloud\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Pro V1\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V1.14.9\",\"lessThan\":\"V1.15.20\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Pro V2\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V2.2.0\",\"lessThan\":\"V2.2.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"Industrial Edge Management Virtual\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V2.6.0\",\"lessThan\":\"V2.9.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-20T13:53:38.227092Z\",\"id\":\"CVE-2026-18963\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-640\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56519\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56520\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56523\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:56524\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-18963\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2511595\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-503852.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Critical",
      "current_release_date": "2026-08-20T22:25:54+00:00",
      "cve": "CVE-2026-18963",
      "id": "CVE-2026-18963",
      "initial_release_date": "2026-08-17T00:00:00+00:00",
      "product_status:fixed": "20",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-18963.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-18963\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-20T13:53:38.227092Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-20T13:53:42.089Z\"}}], \"cna\": {\"title\": \"Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank James Paremain for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Critical\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.4.15-1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-operator-bundle\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.4-23\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.4-23\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4.15\", \"packageName\": \"keycloak-services\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.4.15\", \"packageName\": \"rhbk-openshift-rhel9/rhbk-openshift-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6.6-1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-operator-bundle\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6-12\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"26.6-12\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhbk/keycloak-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.6\", \"packageName\": \"keycloak-services\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.6\", \"packageName\": \"rhbk-keycloak-rhel9/rhbk-keycloak-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:26.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Keycloak 26.6.6\", \"packageName\": \"rhbk-openshift-rhel9/rhbk-openshift-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"keycloak-services\", \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"keycloak-services\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-31T15:46:15.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-08-17T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-08-17T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:56519\", \"name\": \"RHSA-2026:56519\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:56520\", \"name\": \"RHSA-2026:56520\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:56523\", \"name\": \"RHSA-2026:56523\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:56524\", \"name\": \"RHSA-2026:56524\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-18963\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2511595\", \"name\": \"RHBZ#2511595\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"If an immediate upgrade is not possible, disabling the \\\"Forgot password\\\" functionality across all realms can be used as a temporary mitigation.\\n\\nIn the RHBK administration console, navigate to:\\n\\nRealm settings \\u2192 Login \\u2192 Forgot password \\u2192 Off\\n\\nApply this setting to all realms.\\n\\nUpgrade to a fixed version as soon as possible.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-640\", \"description\": \"Weak Password Recovery Mechanism for Forgotten Password\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-08-20T22:25:58.686Z\"}, \"x_redhatCweChain\": \"CWE-640: Weak Password Recovery Mechanism for Forgotten Password\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-18963\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-20T22:25:58.686Z\", \"dateReserved\": \"2026-08-05T15:00:40.360Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-08-18T17:05:07.478Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

SSA-503852

Vulnerability from csaf_siemens - Published: 2026-09-08 00:00 - Updated: 2026-09-08 00:00

Summary

SSA-503852: Authentication Bypass Vulnerability in Industrial Edge Management

Notes

Summary: Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versions.

General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use: The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

CVE-2026-18963

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Affected products

Known affected 4 products

Product	Version	Remediation
Industrial Edge Management Cloud Siemens / Industrial Edge Management Cloud	vers:all/*	Mitigation Mitigation Mitigation Vendor Fix
Industrial Edge Management Pro V1 >= V1.14.9 < V1.15.20 Siemens / Industrial Edge Management Pro V1	vers:intdot/>=1.14.9\|<1.15.20	Mitigation Mitigation Mitigation Vendor Fix fix
Industrial Edge Management Pro V2 >= V2.2.0 < V2.2.2 Siemens / Industrial Edge Management Pro V2	vers:intdot/>=2.2.0\|<2.2.2	Mitigation Mitigation Mitigation Vendor Fix fix
Industrial Edge Management Virtual >= V2.6.0 < V2.9.1 Siemens / Industrial Edge Management Virtual	vers:intdot/>=2.6.0\|<2.9.1	Mitigation Mitigation Mitigation Vendor Fix fix

References

2 references

URL	Category
https://cert-portal.siemens.com/productcert/html/…	self
https://cert-portal.siemens.com/productcert/csaf/…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification.\n\nSiemens has released new versions for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-503852: Authentication Bypass Vulnerability in Industrial Edge Management - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-503852.html"
      },
      {
        "category": "self",
        "summary": "SSA-503852: Authentication Bypass Vulnerability in Industrial Edge Management - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-503852.json"
      }
    ],
    "title": "SSA-503852: Authentication Bypass Vulnerability in Industrial Edge Management",
    "tracking": {
      "current_release_date": "2026-09-08T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-503852",
      "initial_release_date": "2026-09-08T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-09-08T00:00:00.000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Industrial Edge Management Cloud",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Management Cloud"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003e=1.14.9|\u003c1.15.20",
                "product": {
                  "name": "Industrial Edge Management Pro V1 \u003e= V1.14.9 \u003c V1.15.20",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Management Pro V1"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003e=2.2.0|\u003c2.2.2",
                "product": {
                  "name": "Industrial Edge Management Pro V2 \u003e= V2.2.0 \u003c V2.2.2",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Management Pro V2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:intdot/\u003e=2.6.0|\u003c2.9.1",
                "product": {
                  "name": "Industrial Edge Management Virtual \u003e= V2.6.0 \u003c V2.9.1",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Industrial Edge Management Virtual"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-18963",
      "cwe": {
        "id": "CWE-640",
        "name": "Weak Password Recovery Mechanism for Forgotten Password"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Block direct internet access to IEM Pro / IEM Virtual\nThe most effective immediate measure is to block direct internet access to your IEM Pro or IEM V instance. This ensures that no external attacks can occur via this vulnerability.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4"
          ]
        },
        {
          "category": "mitigation",
          "details": "Configure a Web Application Firewall (WAF) or Reverse Proxy\nIf complete blocking of internet access is not immediately feasible, you can use a Web Application Firewall (WAF) or a Reverse Proxy to block the affected path. Please configure your WAF or Reverse Proxy to block the following path:\n/auth/realms/customer/login-actions/reset-credentials\nPlease note that by blocking this path, the password reset functionality will be unavailable.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4"
          ]
        },
        {
          "category": "mitigation",
          "details": "Deactivate Password Reset in Keycloak Realm Settings\nDeactivate the password reset functionality directly within the Keycloak realm settings. To do this, navigate to:\nIdentity \u0026amp; access management \u0026gt; realm settings \u0026gt; Login \u0026gt; Forgot password \u0026gt; Off\nPlease note that by deactivating this setting, the password reset functionality will be unavailable.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.15.20 or later version",
          "product_ids": [
            "2"
          ],
          "url": "https://iehub.eu1.edge.siemens.cloud/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.2.2 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://iehub.eu1.edge.siemens.cloud/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.9.1 or later version",
          "product_ids": [
            "4"
          ],
          "url": "https://iehub.eu1.edge.siemens.cloud/"
        },
        {
          "category": "vendor_fix",
          "details": "Vulnerability mitigated with firewall rules on 2026-08-26 and fixed with update on 2026-09-02; no user actions necessary",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4"
          ]
        }
      ],
      "title": "CVE-2026-18963"
    }
  ]
}

WID-SEC-W-2026-2915

Vulnerability from csaf_certbund - Published: 2026-08-18 22:00 - Updated: 2026-08-24 22:00

Summary

Keycloak: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Keycloak ermöglicht Single Sign-On mit Identity and Access Management für moderne Anwendungen und Dienste.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Benutzerkonten zu übernehmen.

Betroffene Betriebssysteme: - Linux - UNIX

CVE-2026-15571

Affected products

Known affected 3 products

Product	Identifier	Version
Open Source Keycloak <26.7.2 Open Source / Keycloak		<26.7.2
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Keycloak Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:keycloak`	Keycloak

CVE-2026-18963

Affected products

Known affected 3 products

Product	Identifier	Version
Open Source Keycloak <26.7.2 Open Source / Keycloak		<26.7.2
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Keycloak Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:keycloak`	Keycloak

CVE-2026-45292

Affected products

Known affected 3 products

Product	Identifier	Version
Open Source Keycloak <26.7.2 Open Source / Keycloak		<26.7.2
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Keycloak Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:keycloak`	Keycloak

CVE-2026-59888

Affected products

Known affected 3 products

Product	Identifier	Version
Open Source Keycloak <26.7.2 Open Source / Keycloak		<26.7.2
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Keycloak Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:keycloak`	Keycloak

CVE-2026-59889

Affected products

Known affected 3 products

Product	Identifier	Version
Open Source Keycloak <26.7.2 Open Source / Keycloak		<26.7.2
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Keycloak Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:keycloak`	Keycloak

References

8 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.keycloak.org/2026/08/keycloak-2672-released	external
https://access.redhat.com/errata/RHSA-2026:56524	external
https://access.redhat.com/errata/RHSA-2026:56523	external
https://access.redhat.com/errata/RHSA-2026:56520	external
https://access.redhat.com/errata/RHSA-2026:56519	external
https://github.com/Red-Darkin/CVE-2026-18963-keycloak	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Keycloak erm\u00f6glicht Single Sign-On mit Identity and Access Management f\u00fcr moderne Anwendungen und Dienste.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Benutzerkonten zu \u00fcbernehmen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2915 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2915.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2915 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2915"
      },
      {
        "category": "external",
        "summary": "Keycloak 26.7.2 release vom 2026-08-18",
        "url": "https://www.keycloak.org/2026/08/keycloak-2672-released"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:56524 vom 2026-08-18",
        "url": "https://access.redhat.com/errata/RHSA-2026:56524"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:56523 vom 2026-08-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:56523"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:56520 vom 2026-08-18",
        "url": "https://access.redhat.com/errata/RHSA-2026:56520"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:56519 vom 2026-08-19",
        "url": "https://access.redhat.com/errata/RHSA-2026:56519"
      },
      {
        "category": "external",
        "summary": "PoC CVE-2026-18963 vom 2026-08-24",
        "url": "https://github.com/Red-Darkin/CVE-2026-18963-keycloak"
      }
    ],
    "source_lang": "en-US",
    "title": "Keycloak: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-24T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-25T05:21:09.000+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2915",
      "initial_release_date": "2026-08-18T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-08-18T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-08-24T22:00:00.000+00:00",
          "number": "2",
          "summary": "PoC f\u00fcr CVE-2026-18963 aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c26.7.2",
                "product": {
                  "name": "Open Source Keycloak \u003c26.7.2",
                  "product_id": "T058290"
                }
              },
              {
                "category": "product_version",
                "name": "26.7.2",
                "product": {
                  "name": "Open Source Keycloak 26.7.2",
                  "product_id": "T058290-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:keycloak:keycloak:26.7.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Keycloak"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Keycloak",
                "product": {
                  "name": "Red Hat Enterprise Linux Keycloak",
                  "product_id": "T050024",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:keycloak"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15571",
      "product_status": {
        "known_affected": [
          "T058290",
          "67646",
          "T050024"
        ]
      },
      "release_date": "2026-08-18T22:00:00.000+00:00",
      "title": "CVE-2026-15571"
    },
    {
      "cve": "CVE-2026-18963",
      "product_status": {
        "known_affected": [
          "T058290",
          "67646",
          "T050024"
        ]
      },
      "release_date": "2026-08-18T22:00:00.000+00:00",
      "title": "CVE-2026-18963"
    },
    {
      "cve": "CVE-2026-45292",
      "product_status": {
        "known_affected": [
          "T058290",
          "67646",
          "T050024"
        ]
      },
      "release_date": "2026-08-18T22:00:00.000+00:00",
      "title": "CVE-2026-45292"
    },
    {
      "cve": "CVE-2026-59888",
      "product_status": {
        "known_affected": [
          "T058290",
          "67646",
          "T050024"
        ]
      },
      "release_date": "2026-08-18T22:00:00.000+00:00",
      "title": "CVE-2026-59888"
    },
    {
      "cve": "CVE-2026-59889",
      "product_status": {
        "known_affected": [
          "T058290",
          "67646",
          "T050024"
        ]
      },
      "release_date": "2026-08-18T22:00:00.000+00:00",
      "title": "CVE-2026-59889"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-18963 (GCVE-0-2026-18963)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

SSA-503852

WID-SEC-W-2026-2915

Tags

Sightings

Nomenclature