---
id: CVE-2026-103112
title: >-
  Keycloak-services: keycloak-services: account takeover via authentication race
  using reset-credentials path
summary: >-
  A flaw was found in the authentication session handling of the
  keycloak-services component in Keycloak. The issue occurs because the system
  fails to verify if an authenticator is valid for the current authentication
  flow when switching b…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-362
vendor: Red Hat
product: keycloak-rhel9-container
affected:
  - keycloak-rhel9-container (all versions)
  - keycloak-rhel9-operator-bundle-container (all versions)
  - keycloak-rhel9-operator-container (all versions)
  - keycloak-services
  - rhbk/keycloak-rhel9
  - keycloak-services (all versions)
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T10:24:03.291Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103112'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:95760'
    label: 'RHSA-2026:95760'
  - url: 'https://access.redhat.com/errata/RHSA-2026:95761'
    label: 'RHSA-2026:95761'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-103112'
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.325Z'
---

## Overview

A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.

## Affected

- `keycloak-rhel9-container (all versions)`
- `keycloak-rhel9-operator-bundle-container (all versions)`
- `keycloak-rhel9-operator-container (all versions)`
- `keycloak-services`
- `rhbk/keycloak-rhel9`
- `keycloak-services (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.