RHSA-2026:99765: Critical: Red Hat Single Sign-On 7.6.14 security update on RHEL 8
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloakproject, that provides authentication and standards-based single sign-oncapabilities for web and mobile applications.This release of Red Hat Single Sign-On 7.6.14 on RHEL 8 serves as a replacementfor Red Hat Single Sign-On 7.6.13, and includes bug fixes and enhancements,which are documented in the Release Notes document linked to in the References.Security Fix(es): Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/rh-sso7-keycloakto a version that resolves this vulnerability.Fixed in 18.0.21-1.redhat_00001.1.el8 - Upgrade
Upgrade
redhat/rh-sso7-keycloak-serverto a version that resolves this vulnerability.Fixed in 18.0.21-1.redhat_00001.1.el8 - Upgrade
Upgrade
Red Hat Single Sign-Onto a version that resolves this vulnerability.Fixed in 7.6.14 - Operational
Before applying the Red Hat Single Sign-On 7.6.14 update, apply all previously released errata relevant to the system.
Event History
Frequently Asked Questions
Does exploitation require an existing account or credentials?
No. The security fix is described as an unauthenticated account takeover through a reset-credentials flow bypass.
Which deployments are covered by this update?
The update covers Red Hat Single Sign-On 7.6.14 on RHEL 8, specifically the redhat/rh-sso7-keycloak and redhat/rh-sso7-keycloak-server software.
What update should administrators apply?
Apply the Red Hat Single Sign-On 7.6.14 update for RHEL 8. It replaces the 7.6.13 release and includes the fix for CVE-2026-18963.