RED HAT BUILD OF KEYCLOAK · CVE-2026-103112 · Other
NO FIX YET
Keycloak's authentication session handling does not check that an authenticator belongs to the current flow when switching between the normal login path and the reset credentials path. An authenticated attacker who wins a race can attach their authentication state to another user's session, take over the account and change its password. Red Hat rates it Important (CVSS 7.5, high attack complexity) and says exploitation needs specific realm configurations. No exploitation reported.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Red Hat lists Red Hat Build of Keycloak and Red Hat Single Sign-On 7 as affected. Upstream Keycloak version ranges are not published yet. Realms where users can reset credentials are the ones to look at; Red Hat says specific realm configurations are needed. The attacker must already hold an account on the realm.
Not affected if unknown
Who cares keycloak, race-condition, red-hat-sso, self-hosted, sso
No fix yet, per the sources.
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.