CVE Alert: CVE-2026-103112 – Red Hat

A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user’s session. This can result in the attacker gaining full access to the victim’s account and changing their password.

**Risk verdict:** This is a high-impact identity-service weakness warranting prompt investigation and remediation; the supplied data does not establish active exploitation or KEV status.

**Why this matters:** A successful attack could let an attacker take control of another user’s identity, change credentials and access services trusted by that identity. The resulting impact may extend beyond the login service to connected applications and sensitive data. Exploitation requires an authenticated foothold and difficult timing, which limits opportunity but does not reduce the potential harm.

**Most likely attack path:** A network-reachable service is required, along with a valid low-privilege account; no victim interaction is indicated. The attacker would coordinate requests across normal authentication and credential-recovery flows to exploit a race condition. Scope is unchanged, so the flaw does not itself cross a security boundary, though compromised accounts may enable access to connected systems.

**Who is most exposed:** Organisations using internet-accessible identity services with self-service credential recovery are most exposed, particularly where accounts grant broad access to business applications.

Alert on overlapping authentication and credential-reset requests for one session or account.

Correlate session identifiers, account IDs and flow transitions for unexpected mismatches.

Review password changes followed by new-device logins or unusual application access.

Investigate reset activity associated with privileged or high-value accounts.

Mitigation and prioritisation:

Check the vendor advisory for fixed builds and plan prompt patching; affected deployments cannot be distinguished without installed-build details.

Restrict external access to the identity service where feasible.

Apply additional monitoring or approval controls to credential resets until patched.

Test authentication and recovery flows after change; review logs for suspicious activity beforehand.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.