---
id: "CVE-2026-103112"
kind: "vulnerability"
aliases: ["CVE-2026-103112"]
title: "Keycloak: race condition during credential reset lets attacker take over accounts"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Red Hat Build of Keycloak", "fixed": [], "affected": "unknown, no ranges published", "ecosystem": "vendor"}, {"name": "Red Hat Single Sign-On 7", "fixed": [], "affected": "unknown, no ranges published", "ecosystem": "vendor"}]
ecosystems: []
tags: ["keycloak", "other", "race-condition", "red-hat-sso", "self-hosted", "sso"]
not_affected_if: ["unknown"]
published_at: "2026-11-05T17:17:32+00:00"
first_seen_at: "2026-11-05T17:40:02+00:00"
updated_at: "2026-11-05T17:47:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103112", "first_seen_at": "2026-11-05T17:40:02+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-103112", "first_seen_at": "2026-11-05T17:47:04+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-103112"]}]
exploit_sources: []
---

# Keycloak: race condition during credential reset lets attacker take over accounts

Keycloak's authentication session handling does not check that an authenticator belongs to the current flow when switching between the normal login path and the reset credentials path. An authenticated attacker who wins a race can attach their authentication state to another user's session, take over the account and change its password. Red Hat rates it Important (CVSS 7.5, high attack complexity) and says exploitation needs specific realm configurations. No exploitation reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Red Hat Build of Keycloak affected unknown, no ranges published fixed no fixed version listed
- vendor:Red Hat Single Sign-On 7 affected unknown, no ranges published fixed no fixed version listed

## How to check

Red Hat lists Red Hat Build of Keycloak and Red Hat Single Sign-On 7 as affected, with no fixed versions yet. Check Red Hat's CVE page for errata. For upstream Keycloak, no affected or fixed range is published yet. Red Hat says exploitation needs specific realm configurations; review whether the Reset Credentials flow is enabled (Realm settings > Login > Forgot password, and the reset credentials flow under Authentication) and limit it if you can.

## Timeline

- 2026-11-05T17:40:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103112
- 2026-11-05T17:47:04+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-103112 — Red Hat CNA page (only primary source, published 2026-11-05) gives no affected/fixed versions and no fix yet; NVD has no analysis. Red Hat rates Important, says exploitation needs a hard race and specific realm configurations. Default state of reset-credentials flow not stated. Upstream keycloak release/GHSA not found yet; revisit when published.

## Documents

- [advisory] Red Hat: CVE-2026-103112 https://access.redhat.com/security/cve/CVE-2026-103112

## From the sources

A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_