RHSA-2026:99763: Critical: Red Hat Single Sign-On 7.6.14 security update
Critical: Red Hat Single Sign-On 7.6.14 security update
Other sources
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloakproject, that provides authentication and standards-based single sign-oncapabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.6.14 serves as a replacement for RedHat Single Sign-On 7.6.13, and includes bug fixes and enhancements, which aredocumented in the Release Notes document linked to in the References.Security Fix(es): Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat Single Sign-Onto a version that resolves this vulnerability.Fixed in 7.6.14 - Operational
Back up the existing Red Hat Single Sign-On installation, including all applications, configuration files, databases, and database settings, before applying the update.
Event History
Frequently Asked Questions
What attacker access is required to exploit this issue?
The issue is described as an unauthenticated account takeover through a reset-credentials flow bypass. An attacker does not need to authenticate before attempting exploitation.
Which deployment versions should be updated?
Red Hat Single Sign-On 7.6.14 replaces version 7.6.13. Deployments running 7.6.13 should update to the replacement release.
What is the potential impact?
Successful exploitation can result in takeover of an account through the reset-credentials process. Because the issue is rated critical, affected authentication infrastructure should be prioritized for remediation.