CVE-2026-103112High· 7.5▾ TwilightA flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching b…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
keycloak-rhel9-container (all versions)keycloak-rhel9-operator-bundle-container (all versions)keycloak-rhel9-operator-container (all versions)keycloak-servicesrhbk/keycloak-rhel9keycloak-services (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96547Medium· 6.5Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
CVE-2026-97367Medium· 6.4Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
CVE-2026-97848Medium· 6.5Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
CVE-2026-114232High· 8.1Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access
CVE-2026-82965High· 7.5Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsing
CVE-2026-93998High· 7.4Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer