CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NA flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Multiple vulnerabilities have been discovered in Keycloak, allowing an attacker to bypass security policies and potentially take control of an account if they know its identifier. The CERT-FR has a proof of concept for C…
This week saw a surge in high-impact cyberattacks and vulnerabilities, highlighting the increasing sophistication and speed of threat actors. AI is now being weaponized to craft exploit scripts targeting Siemens PLCs, wh…
A critical vulnerability (CVE-2026-18963) in Keycloak allows unauthenticated attackers to force a password reset and take over any user account, including administrative accounts. Red Hat and Keycloak have released patch…
