CVE-2026-125652: Keycloak-services: keycloak-services: client-level mandatory pkce bypass via login-actions entry point
A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier.
Other sources
A flaw was found in the org.keycloak.services package of Keycloak. When an authentication flow is initiated through the login-actions/reset-credentials entry point, the resulting authorization session fails to evaluate and apply client-level mandatory PKCE settings. If a user subsequently navigates back to the standard login form and completes authentication, Keycloak issues an authorization code that lacks associated code challenge metadata. Because the token endpoint validates PKCE based on the presence of metadata in the code rather than the client configuration, the code can be redeemed for tokens without a codeverifier. An attacker who intercepts this authorization code can perform a code injection attack to obtain access and refresh tokens, allowing them to impersonate the victim and access or modify protected data.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to intercept a user's login authorization code and the user must initiate login after visiting the password reset page. Exploitation also requires user interaction, as reflected by the UI:R vector.
Which deployments are exposed?
The issue affects Keycloak deployments using the keycloak-services component where PKCE is configured as mandatory at the client level. The provided information does not identify affected versions or whether this configuration is enabled by default.
What is the security impact if exploitation succeeds?
An attacker who obtains the intercepted login code may access the user's account without presenting the required PKCE verifier. The stated impact includes high confidentiality and integrity impact, with no availability impact.