RHSA-2026:99764: Critical: Red Hat Single Sign-On 7.6.14 security update on RHEL 7
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloakproject, that provides authentication and standards-based single sign-oncapabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.6.14 on RHEL 7 serves as a replacementfor Red Hat Single Sign-On 7.6.13, and includes bug fixes and enhancements,which are documented in the Release Notes document linked to in the References.Security Fix(es): Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 18.0.21-1.redhat_00001.1.el7 - Upgrade
Upgrade
redhat/rh-sso7-keycloak-serverto a version that resolves this vulnerability.Fixed in 18.0.21-1.redhat_00001.1.el7 - Upgrade
Upgrade
Red Hat Single Sign-Onto a version that resolves this vulnerability.Fixed in 7.6.14
Event History
Frequently Asked Questions
Which deployments are affected by this update?
The advisory applies to Red Hat Single Sign-On 7.6 deployments on RHEL 7 using the rh-sso7-keycloak or rh-sso7-keycloak-server software.
Does exploitation require an authenticated account?
No. The listed issue is an unauthenticated account takeover through a bypass in the reset-credentials flow.
What version should be deployed to remediate the issue?
Update Red Hat Single Sign-On 7.6 on RHEL 7 to release 7.6.14, which replaces 7.6.13 and includes the security fix.