A critical vulnerability has been reported in Keycloak, which could allow an unauthenticated attacker to bypass the password reset mechanism and take over arbitrary user accounts, including administrative accounts.
Target Audience:
Organizations and administrators using affected versions of Keycloak and Red Hat build of Keycloak (RHBK).
Risk Assessment:
Critical risk of unauthenticated account takeover, unauthorized access, and compromise of administrative accounts.
Impact Assessment:
Potential for authentication bypass, unauthorized password reset, account takeover, and privilege escalation through compromised administrative accounts.
The information provided herein is on "as is" basis, without warranty of any kind.