{"affected":[{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-operator-bundle","product":"Red Hat build of Keycloak 26.6","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6.8-2","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.6","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6-24","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"rhbk/keycloak-rhel9-operator","product":"Red Hat build of Keycloak 26.6","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"26.6-24","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","product":"Red Hat build of Keycloak 26.6.8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","product":"Red Hat build of Keycloak 26.6.8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","product":"Red Hat Single Sign-On 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-112208","cwes":["CWE-305"],"description":"A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.","epss":{"date":"2026-11-06","percentile":0.32868,"score":0.00386},"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":8.1,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793994923323,"publishedAt":1793894705257,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:95761"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:95762"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-112208"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555473"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:95761"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-112208"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555473"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n--- CME Mitigation Guidance (2026-11-06) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to ensure the SSO_AUTH re-authentication note is cleared from the authentication session whenever a flow transition strips the authenticated user: upgrade to Red Hat build of Keycloak 26.6.8 (or the fixed Rhbk/Keycloak Rhel/Keycloak Services builds), which clears the lingering SSO_AUTH re-authentication note from the authentication session during login flow transitions such as registration or credential reset, closing all 2 injection vectors (transition to credential reset flow, transition to registration flow). Until patched, this is a concern on Keycloak deployments with the Organization feature enabled and users holding credentials in multiple organizations, so Disable the Organization feature or ensure users cannot hold memberships across multiple organizations. These controls limit blast radius and contain exploitation, but they do not fix the underlying stale authentication state flag defect — apply the upstream patch to fully remediate."}],"revision":"ef1ee63ed2a5c83bbcd5867a99a1c4c5aaaf29e4beefd4cb4895ae4dfeee8107","sources":[{"modifiedAt":1793994923323,"name":"CNA: redhat","retrievedAt":1793995753329,"url":"https://www.cve.org/CVERecord?id=CVE-2026-112208"},{"modifiedAt":1793963824233,"name":"NVD","retrievedAt":1793967508621,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112208"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793988719668,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112208"}],"ssvc":null,"status":"published","title":"Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first login","updatedAt":1793995753329}