{"id":"CVE-2026-125652","kind":"vulnerability","aliases":["CVE-2026-125652"],"related":[],"title":"Keycloak: password reset page lets a login skip PKCE checks","description":"A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier.","summary":"Keycloak skips mandatory PKCE checks when a user starts a login after visiting the password reset page. An attacker who intercepts a login code can exchange it for a session without the code verifier and take over the user's account.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","keycloak","oauth","self-hosted","sso"],"not_affected_if":["no-pkce-clients","password-reset-disabled"],"how_to_check":"- Check the Keycloak version in use against the affected ranges in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-125652)\n- Confirm whether clients rely on PKCE and whether the password reset flow is enabled in the realm","fix":null,"status":"open","published_at":"2026-11-10T08:16:41+00:00","first_seen_at":"2026-11-10T08:20:42+00:00","triaged_at":"2026-11-10T08:22:53+00:00","updated_at":"2026-11-10T08:22:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T08:22:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: password reset page lets a login skip PKCE checks","impact":"high","summary":"Keycloak skips mandatory PKCE checks when a user starts a login after visiting the password reset page. An attacker who intercepts a login code can exchange it for a session without the code verifier and take over the user's account.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","self-hosted","oauth","sso"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker takes over user accounts via intercepted login codes","analyst_note":"Find the affected and fixed Keycloak versions and the upstream advisory from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-125652); the sources give no version ranges.","how_to_check":"- Check the Keycloak version in use against the affected ranges in the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-125652)\n- Confirm whether clients rely on PKCE and whether the password reset flow is enabled in the realm\n- unknown for anything beyond this, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-pkce-clients","password-reset-disabled"],"who_is_affected":"Any organization running Keycloak as its identity provider with PKCE-protected clients and the password reset flow enabled is potentially exposed. The sources do not list affected or fixed versions, so the exact ranges are unknown. Deployments that do not use PKCE or do not offer password reset are likely less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000767,"input_tokens":4588,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125652':13A,16A '-2026':12A,15A 'access':132C 'account':64B,137C 'allow':121C 'attack':42B,123C 'authent':81C 'author':83C 'caus':104C 'check':10A,28B,111C 'code':47B,56B,116C,128C 'compon':74C 'core':80C 'could':120C 'cve':11A,14A 'exchang':49B,117C 'flaw':66C 'found':68C 'gain':130C 'host':22B 'ident':87C 'infrastructur':17B 'initi':95C 'intercept':44B,125C 'issu':90C 'key':114C 'keycloak':1A,18B,24B,72C,76C 'keycloak-servic':71C 'let':5A 'logic':84C 'login':7A,34B,46B,97C,127C 'mandatori':26B,109C 'need':139C 'oauth':19B 'occur':91C 'page':4A,40B,103C 'password':2A,38B,101C 'pkce':9A,27B,118C 'proof':113C 'provid':78C,88C 'requir':141C 'reset':3A,39B,102C 'secur':110C,142C 'self':21B 'self-host':20B 'servic':73C 'session':53B 'skip':8A,25B,108C 'sso':23B 'start':32B 'system':106C 'take':59B 'unauthor':131C 'user':31B,62B,94C,135C 'verifi':57B,143C 'visit':36B,99C 'without':54B,138C","nicknames":[],"mitigations":[],"who_affected":"Any organization running Keycloak as its identity provider with PKCE-protected clients and the password reset flow enabled is potentially exposed. The sources do not list affected or fixed versions, so the exact ranges are unknown. Deployments that do not use PKCE or do not offer password reset are likely less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","keycloak","medium","oauth","selfhosted","sso"],"campaign_type":null,"search_a":"'-125652':13A,16A '-2026':12A,15A 'check':10A 'cve':11A,14A 'keycloak':1A 'let':5A 'login':7A 'page':4A 'password':2A 'pkce':9A 'reset':3A 'skip':8A","search_b":"'account':64B 'attack':42B 'check':28B 'code':47B,56B 'exchang':49B 'host':22B 'infrastructur':17B 'intercept':44B 'keycloak':18B,24B 'login':34B,46B 'mandatori':26B 'oauth':19B 'page':40B 'password':38B 'pkce':27B 'reset':39B 'self':21B 'self-host':20B 'session':53B 'skip':25B 'sso':23B 'start':32B 'take':59B 'user':31B,62B 'verifi':57B 'visit':36B 'without':54B","search_c":"'access':132C 'account':137C 'allow':121C 'attack':123C 'authent':81C 'author':83C 'caus':104C 'check':111C 'code':116C,128C 'compon':74C 'core':80C 'could':120C 'exchang':117C 'flaw':66C 'found':68C 'gain':130C 'ident':87C 'initi':95C 'intercept':125C 'issu':90C 'key':114C 'keycloak':72C,76C 'keycloak-servic':71C 'logic':84C 'login':97C,127C 'mandatori':109C 'need':139C 'occur':91C 'page':103C 'password':101C 'pkce':118C 'proof':113C 'provid':78C,88C 'requir':141C 'reset':102C 'secur':110C,142C 'servic':73C 'skip':108C 'system':106C 'unauthor':131C 'user':94C,135C 'verifi':143C 'visit':99C 'without':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T08:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125652","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125652","severity":null,"published_at":"2026-11-10T08:16:41+00:00","modified_at":"2026-11-10T08:16:42+00:00","first_seen_at":"2026-11-10T08:20:42+00:00","fetched_at":"2026-11-10T08:20:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}