commitment
Red Hat Build of Keycloak users should apply RHSA-2026:56519 / 56520 / 56523 / 56524.
A commitment by turansecurity. Statements are as reported by the cited publishers — not verified by DecisionGateway.
Red Hat Build of Keycloak foydalanuvchilari: RHSA-2026:56519 / 56520 / 56523 / 56524 ni qo'llang.
Discussion
Related claims
A critical vulnerability in Keycloak's reset-credentials (CVE-2026-18963, CVSS 9.1) allows any authenticated user, including administrators, to complete a password reset and set a new password.turansecurity · allegationUpgrade to 26.7.2 / 26.6.6 / 26.4.15 (LTS); the fix is also available in 26.8.0.turansecurity · commitmentThe risk level is Critical with CVSS v4.0 score 9.2, tracked as CVE-2026-109618 and CVE-2026-109619.Turan Security Xavfsizlik Byulleteni · statementAll versions prior to 26.7.2, 26.6.6 and 26.4.15 (LTS) are affected.turansecurity · statementUnsupported branches (26.5, 26.3 and older) will not be fixed and remain permanently vulnerable until upgraded.turansecurity · predictionVersions 19.1.8, 19.2.6, 19.3.2 or later are safe versions.Turan Security xavfsizlik byulleteni · statement
More claims by turansecurity
Upgrade to 26.7.2 / 26.6.6 / 26.4.15 (LTS); the fix is also available in 26.8.0.commitmentUnsupported branches (26.5, 26.3 and older) will not be fixed and remain permanently vulnerable until upgraded.predictionAll versions prior to 26.7.2, 26.6.6 and 26.4.15 (LTS) are affected.statementExploit code has not yet been distributed, but the CVE is confirmed.statementThe cause is improper implementation of state checking (CWE-640).statement
All claims by turansecurity