Description

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T17:16:57.083Z",
  "pubdate": "2026-08-18T17:16:57.083Z",
  "executiveSummary": "A critical security flaw has been identified within the reset-credentials flow of the keycloak-services component in Red Hat Build of Keycloak. This vulnerability is classified as an authentication bypass and improper authorization flaw, which enables an unauthenticated remote attacker to compromise arbitrary user accounts. The primary business and security impact is complete account takeover, leading to potential unauthorized data access, privilege escalation, and full administrative or standard user control depending on the targeted account. The affected product is Red Hat Build of Keycloak, specifically impacting the core identity and access management engine governing credential lifecycle operations. Risk implications are severe, as identity providers represent central trust boundaries within enterprise architectures; compromising this component jeopardizes the entire federated ecosystem. Attacker capabilities include the direct manipulation of the credential reset mechanism without interacting with out-of-band verification channels. Exploitation requirements are minimal regarding authentication, as the attack can be executed by an unauthenticated entity, though specific interaction with the vulnerable reset-credentials endpoint is necessary to initiate and finalize the malicious sequence.",
  "technicalDetails": "The vulnerability resides within the credential recovery and reset-credentials flow handled by the keycloak-services component of Red Hat Build of Keycloak. The root cause stems from insufficient validation and state enforcement during the multi-step password reset procedure. Specifically, the application fails to adequately cryptographically enforce or verify that the prerequisite email verification link has been successfully processed and acknowledged by the legitimate account owner before permitting the final credential modification phase.\nExploitation occurs when an unauthenticated attacker initiates the password reset sequence for a targeted user identifier. Due to the breakdown in state validation within the keycloak-services component, the attacker can bypass the mandatory email verification step entirely. Rather than waiting for the victim to receive, review, and click the verification link dispatched via email, the attacker directly interacts with subsequent sequential endpoints or injects parameters into the reset-credentials workflow.\nThe attack flow proceeds as follows: First, the attacker triggers a password reset request for the target user via the standard interface. Second, instead of intercepting or awaiting the verification token from the out-of-band communication channel, the attacker leverages the logical flaw to skip the verification gate. Third, the attacker submits a direct payload to the endpoint responsible for setting new credentials. Because the underlying logic fails to validate whether the preceding email verification state was successfully satisfied, the application processes the request as legitimate.\nThe vulnerable component is the keycloak-services engine responsible for processing identity management workflows. Authentication requirements are non-existent, meaning the attacker operates as an unauthenticated external entity. Privilege requirements are similarly absent prior to exploitation. The network exposure is dictated by the exposure of the Keycloak authentication service to the network, typically accessible via HTTP or HTTPS protocols. Post-exploitation impact results in full account control, allowing the attacker to directly establish new credentials, log into the system with the privileges of the victim, and potentially escalate access if the targeted account possesses administrative roles within the Keycloak realm."
}