RHSA-2026:56520CriticalCVSS 9.1

Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Security Update

Published
August 18, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-18963 →

📋 Description

CVE-2026-18963 — keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

🎯 Affected products1

  • Red Hat build of Keycloak 26.4.15

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: If an immediate upgrade is not possible, disabling the "Forgot password" functionality across all realms can be used as a temporary mitigation. In the RHBK administration console, navigate to: Realm settings → Login → Forgot password → Off Apply this setting to all realms. Upgrade to a fixed version as soon as possible.

🔗 References (3)