CVE-2026-94001: fallo de gravedad media en Red Hat build of Keycloak 26.6
Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.4%
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Productos afectados
Red Hat · Red Hat build of Keycloak 26.6Red Hat · Red Hat build of Keycloak 26.6.8Red Hat · Red Hat Single Sign-On 7CVEs relacionadas — Red Hat build of Keycloak 26.6
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-18963CRITICALKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassEPSS 4.7%CVE-2023-5685HIGHXnio: stackoverflowexception when the chain of notifier states becomes problematically bigEPSS 3.5%CVE-2024-3656HIGHKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesEPSS 3.3%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2026-76166MEDIUMModcluster-core: mod_cluster advertise listener: unauthenticated dos via crafted multicast datagramEPSS 2.7%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%