Threat News

Red Hat Keycloak Critical Flaw Lets Unauthenticated Attackers Reset Any Account Password

A critical flaw in the reset-credentials flow of Red Hat Build of Keycloak lets a remote, unauthenticated attacker skip the email verification step and set a new password for any user. Fixed builds are available for the 26.4 and 26.6 streams and upstream Keycloak 26.7.2; disabling "Forgot password" is the interim workaround.