RHSA-2026:56520CriticalCVSS 9.1

Red Hat Security Advisory: Red Hat build of Keycloak 26.4.15 Security Update

Published
August 18, 2026
Last Modified
October 23, 2026

🔗 CVE IDs covered (2)

CVE-2026-18963 →CVE-2026-54291 →

📋 Description

CVE-2026-18963 — keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass CVE-2026-54291 — org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

🎯 Affected products1

  • Red Hat build of Keycloak 26.4.15

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Workaround: If an immediate upgrade is not possible, disabling the "Forgot password" functionality across all realms can be used as a temporary mitigation. In the RHBK administration console, navigate to: Realm settings → Login → Forgot password → Off Apply this setting to all realms. Upgrade to a fixed version as soon as possible.

🔗 References (3)