EUVD Vulnerability Catalog
EUVD-2026-61063
Severity: CRITICAL
Base Score: 9.1
CVSS Version: 3.1
Vulnerability Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Privileges Required (PR): None
▪
User Interaction (UI): None
▪
Scope (S): Unchanged
▪
Confidentiality Impact (C): High
▪
Integrity Impact (I): High
▪
Availability Impact (A): None
Affected Vendors & Systems
Vendor
Red Hat
References & Advisory Links
- https://access.redhat.com/errata/RHSA-2026:56519
- https://access.redhat.com/errata/RHSA-2026:56520
- https://access.redhat.com/errata/RHSA-2026:56523
- https://access.redhat.com/errata/RHSA-2026:56524
- https://access.redhat.com/errata/RHSA-2026:99763
- https://access.redhat.com/security/cve/CVE-2026-18963
- https://bugzilla.redhat.com/show_bug.cgi?id=2511595
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
redhat
EPSS Probability
6.59
Known Aliases
CVE-2026-18963
GHSA-4gv3-mc9p-5wqc
Published On
2026-08-18
Last Updated
2026-11-12