CVE-2026-125652 · Infrastructure
NO FIX YET
Keycloak skips mandatory PKCE checks when a user starts a login after visiting the password reset page. An attacker who intercepts a login code can exchange it for a session without the code verifier and take over the user's account.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any organization running Keycloak as its identity provider with PKCE-protected clients and the password reset flow enabled is potentially exposed. The sources do not list affected or fixed versions, so the exact ranges are unknown. Deployments that do not use PKCE or do not offer password reset are likely less exposed.
Not affected if no-pkce-clients, password-reset-disabled
Who cares keycloak, oauth, self-hosted, sso
No fix yet, per the sources.
A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.