CVE-2026-103112
Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
Fixes and workarounds
Workaround
--- CME Mitigation Guidance (2026-11-06) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to validate that the requested authenticator ID belongs to the active execution flow when switching between authenticate and reset-credentials endpoints in keycloak-services: upgrade to Red Hat build of Keycloak 26.4.17, 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which validate that the requested authenticator ID is present in the active execution flow when switching between authenticate and reset-credentials endpoints, closing concurrent race condition between reset-credentials and authenticate endpoints during flow switching. Until patched, this is a concern on Keycloak deployments with Forgot Credentials enabled and users without two-factor authentication, so Enforce two-factor authentication for all realm users or disable the Forgot Credentials feature to prevent cross-flow identity binding. These controls limit blast radius and contain exploitation, but they do not fix the underlying authentication race condition defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-801 Multi-Factor Authentication (MFA) (high)
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat build of Keycloak 26.4 Red Hat rhbk/keycloak-operator-bundle
https://catalog.redhat.com/software/containers/ |
≥ 26.4.17-2; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 26.4 Red Hat rhbk/keycloak-rhel9
https://catalog.redhat.com/software/containers/ |
≥ 26.4-29; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 26.4 Red Hat rhbk/keycloak-rhel9-operator
https://catalog.redhat.com/software/containers/ |
≥ 26.4-30; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 26.4.17 Red Hat keycloak-services
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat build of Keycloak 26.4.17 Red Hat rhbk/keycloak-rhel9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat build of Keycloak 26.6 Red Hat rhbk/keycloak-operator-bundle
https://catalog.redhat.com/software/containers/ |
≥ 26.6.8-2; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 26.6 Red Hat rhbk/keycloak-rhel9
https://catalog.redhat.com/software/containers/ |
≥ 26.6-24; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 26.6 Red Hat rhbk/keycloak-rhel9-operator
https://catalog.redhat.com/software/containers/ |
≥ 26.6-24; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat build of Keycloak 26.6.8 Red Hat keycloak-services
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat build of Keycloak 26.6.8 Red Hat rhbk/keycloak-rhel9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Single Sign-On 7 Red Hat keycloak-services
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | CNA: redhat |
| 3.1 / 7.5 high |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2026:95759CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95760CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95761CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95762CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-103112CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:95759[email protected]
- https://access.redhat.com/errata/RHSA-2026:95760[email protected]
- https://access.redhat.com/errata/RHSA-2026:95761[email protected]
- https://access.redhat.com/errata/RHSA-2026:95762[email protected]
- https://access.redhat.com/security/cve/CVE-2026-103112[email protected]
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.