{"id":"CVE-2026-103112","kind":"vulnerability","aliases":["CVE-2026-103112"],"related":[],"title":"Keycloak: race condition during credential reset lets attacker take over accounts","description":"A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.","summary":"Keycloak's authentication session handling does not check that an authenticator belongs to the current flow when switching between the normal login path and the reset credentials path. An authenticated attacker who wins a race can attach their authentication state to another user's session, take over the account and change its password. Red Hat rates it Important (CVSS 7.5, high attack complexity) and says exploitation needs specific realm configurations. No exploitation reported.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Red Hat Build of Keycloak","fixed":[],"affected":"unknown, no ranges published","ecosystem":"vendor"},{"name":"Red Hat Single Sign-On 7","fixed":[],"affected":"unknown, no ranges published","ecosystem":"vendor"}],"ecosystems":[],"tags":["keycloak","other","race-condition","red-hat-sso","self-hosted","sso"],"not_affected_if":["unknown"],"how_to_check":"Red Hat lists Red Hat Build of Keycloak and Red Hat Single Sign-On 7 as affected, with no fixed versions yet. Check Red Hat's CVE page for errata. For upstream Keycloak, no affected or fixed range is published yet. Red Hat says exploitation needs specific realm configurations; review whether the Reset Credentials flow is enabled (Realm settings > Login > Forgot password, and the reset credentials flow under Authentication) and limit it if you can.","fix":null,"status":"open","published_at":"2026-11-05T17:17:32+00:00","first_seen_at":"2026-11-05T17:40:02+00:00","triaged_at":"2026-11-05T17:42:30+00:00","updated_at":"2026-11-05T17:47:04+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T17:42:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: race condition during credential reset lets attacker take over accounts","impact":"high","summary":"Keycloak's authentication session handling does not check that an authenticator belongs to the current flow when switching between standard login and reset credentials. An authenticated attacker can race the credential reset to attach their session to another user's session, gaining full access to the victim's account and the ability to change its password.","audience":"businesses","category":"other","nicknames":[],"who_cares":["keycloak","self-hosted","sso"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker takes over another user's account and changes its password","analyst_note":"Find the NVD entry's affected and fixed Keycloak version ranges and whether the reset credentials flow is on by default.","how_to_check":"- Check the installed Keycloak version against the fixed versions in the sources (unknown in the sources given).\n- Confirm whether the reset credentials flow is enabled in the realm's authentication settings (unknown in the sources given).","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Keycloak deployments that handle login through the standard authentication path and the reset credentials path. The sources do not name the exact versions or configurations affected, so the exposure is unknown beyond the component name.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4266,"output_tokens":510,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the NVD entry's affected and fixed Keycloak version ranges and whether the reset credentials flow is on by default.","search":"'-103112':14A,17A '-2026':13A,16A '7':29A '7.5':102B 'access':199C 'account':11A,91B,204C 'anoth':84B,187C 'associ':181C 'attach':79B 'attack':8A,73B,104B,166C,196C 'authent':45B,53B,72B,81B,122C,144C,150C,157C,165C,184C 'belong':54B 'build':20A 'chang':93B,206C 'check':50B 'complex':105B 'compon':130C 'condit':3A,34B,174C 'configur':112B 'credenti':5A,69B,162C,177C 'current':57B,149C 'cve':12A,15A 'cvss':101B 'exploit':108B,114B,168C 'fail':139C 'flaw':117C 'flow':58B,151C 'found':119C 'full':198C 'gain':197C 'handl':47B,124C 'hat':19A,24A,37B,97B 'high':103B 'host':41B 'import':100B 'issu':134C 'keycloak':1A,22A,30B,43B,128C,132C 'keycloak-servic':127C 'let':7A 'login':64B 'need':109B 'normal':63B 'occur':135C 'of':21A 'on':28A 'password':95B,208C 'path':65B,70B,158C,163C 'process':179C 'race':2A,33B,77B,173C 'race-condit':32B 'rate':98B 'realm':111B 'red':18A,23A,36B,96B 'red-hat-sso':35B 'report':115B 'reset':6A,68B,161C,178C 'result':193C 'say':107B 'self':40B 'self-host':39B 'servic':129C 'session':46B,87B,123C,190C 'sign':27A 'sign-on':26A 'single':25A 'specif':110B 'sso':38B,42B 'standard':156C 'state':82B,185C 'success':183C 'switch':60B,153C 'system':138C 'take':9A,88B 'trigger':171C 'user':85B,188C 'valid':146C 'verifi':141C 'victim':202C 'win':75B","nicknames":[],"mitigations":[],"who_affected":"Red Hat lists Red Hat Build of Keycloak and Red Hat Single Sign-On 7 as affected. Upstream Keycloak version ranges are not published yet. Realms where users can reset credentials are the ones to look at; Red Hat says specific realm configurations are needed. The attacker must already hold an account on the realm.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hatbuildofkeycloak","hatsinglesignon7","redhatbuildofkeycloak","redhatsinglesignon7"],"ptokens":["build","hat","keycloak","of","on","red","sign","single"],"labels":["high","keycloak","other","racecondition","redhatsso","selfhosted","sso"],"campaign_type":null,"first_public_at":"2026-11-05T17:17:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103112","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103112","severity":null,"published_at":"2026-11-05T17:17:32+00:00","modified_at":"2026-11-05T17:17:32+00:00","first_seen_at":"2026-11-05T17:40:02+00:00","fetched_at":"2026-11-05T17:40:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103112:1810","url":"https://access.redhat.com/security/cve/CVE-2026-103112","severity":null,"published_at":"2026-11-05T17:47:04+00:00","modified_at":"2026-11-05T17:47:04+00:00","first_seen_at":"2026-11-05T17:47:04+00:00","fetched_at":"2026-11-05T17:47:04+00:00","note":"Red Hat CNA page (only primary source, published 2026-11-05) gives no affected/fixed versions and no fix yet; NVD has no analysis. Red Hat rates Important, says exploitation needs a hard race and specific realm configurations. Default state of reset-credentials flow not stated. Upstream keycloak release/GHSA not found yet; revisit when published.","cites":["https://access.redhat.com/security/cve/CVE-2026-103112"]}],"documents":[{"id":78377,"url":"https://access.redhat.com/security/cve/CVE-2026-103112","title":"Red Hat: CVE-2026-103112","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}