CVE-2026-103112: Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated and able to trigger a race condition during the credential reset process. Exploitation can associate the attacker's successful authentication state with another user's session.
What is the potential impact if exploitation succeeds?
The attacker can gain full access to the victim's account and change the victim's password, affecting confidentiality, integrity, and availability of that account.
Which component and workflow should be prioritized for investigation?
Prioritize the keycloak-services component, specifically authentication-session handling where the standard authentication path switches to the reset-credentials path. The flaw involves failure to verify that an authenticator is valid for the current authentication flow.