Top Tweets for #Authn

🚨 Critical Keycloak Vulnerability Enables Unauthenticated Account Takeover Red Hat has disclosed CVE-2026-18963, a critical vulnerability affecting the reset-credentials flow in the keycloak-services component used by Red Hat Build of Keycloak. * CVE: CVE-2026-18963 * Severity: CRITICAL * CVSS: 9.1/10 * CWE: CWE-640 — Weak Password Recovery Mechanism * Attack vector: Network * Attack complexity: Low * Privileges required: None * User interaction: None The vulnerability results from improper state validation within Keycloak's reset-credentials authentication flow. An unauthenticated remote attacker can potentially force the password-reset process for a target account WITHOUT requiring the victim to click the expected email verification link. Successful exploitation can allow the attacker to directly establish new credentials and gain full control of the targeted user account. ⚠️ Why This Matters: Keycloak is an identity and access management platform. Compromising an identity account can therefore have consequences beyond a single application, particularly where Keycloak provides centralized authentication or SSO for multiple services. 🛡️ Mitigation: Red Hat recommends upgrading to a fixed version as soon as possible. If immediate upgrading is not possible, Red Hat recommends temporarily disabling "Forgot password" across ALL realms: Realm Settings → Login → Forgot password → Off ⚠️ Analyst Note: This should receive immediate attention from organizations running affected Red Hat Build of Keycloak deployments. The combination of remote exploitation, no authentication requirement, low attack complexity and no required victim interaction makes the vulnerability particularly concerning. At the time of checking, NVD lists the Red Hat CNA score of 9.1 but has not yet provided its own NVD CVSS assessment. Source: Red Hat Product Security https://t.co/Ed7x6M2mEG NVD: https://t.co/Ime2BSzUiu #DDW #CyberSecurity #Keycloak #RedHat #CVE #Vulnerability #IAM #ThreatIntelligence