Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path
Affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 only under specific realm configurations. No fix is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Specific realm configurations are required A race condition must be triggered during the credential reset process
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 31/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Keycloak's keycloak-services component contains an authentication race condition that lets an attacker who already has a low-privilege login take over another user's account and change its password. The attack can be carried out remotely over the network, and it requires a race during the credential reset process.
Read the original description
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach10/20Shipped in major Linux distributions
- Severity7.5/10CVSS 7.5
- No patch5/5No patch listed yet
What would change the score
- Would score about 81 if added to CISA KEV
- Would score about 76 if CISA's SSVC rates exploitation active
- Would score about 38 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Specific realm configurations are required A race condition must be triggered during the credential reset processWorkaround: The checked facts list no workaround. Until a fix is available, review realm configurations against the conditions the advisory describes.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- keycloak-services
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- keycloak-services
Version range not reported
Evidence 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-103112
Is CVE-2026-103112 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A race condition triggered during the credential reset process can let an attacker gain full access to a victim's account and change their password.Source: access.redhat.com
Am I affected, and how do I check?
The checked facts list Red Hat Build of Keycloak and Red Hat Single Sign-On 7 but give no version ranges. Exposure depends on specific realm configurations, so check the realm settings and product version against the Red Hat advisory.Source: access.redhat.com
How do I fix CVE-2026-103112?
The checked facts give no fixed version, so check the Red Hat advisory for an update target before changing anything.Source: access.redhat.com
What if there's no patch?
The checked facts list no workaround. Until a fix is available, review realm configurations against the conditions the advisory describes.Source: access.redhat.com