Red Hat Security Advisory

RHSA-2026:56519

Red Hat build of Keycloak 26.4.15 Images Security Update

Released 2026-08-18 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator

Fixes 1 record

TI-2026-15499 CVE-2026-18963 · GHSA-4gv3-mc9p-5wqc

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

MEDIUM 55

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.04682 Published 2026-08-18 Partial fix · 26.4.15-1, 26.4-23 +5 CWE-640