RHSA-2026:99767: Critical: Red Hat Single Sign-On 7.6.14 for OpenShift image security update
Critical: Red Hat Single Sign-On 7.6.14 for OpenShift image security update
Other sources
Red Hat Single Sign-On is an integrated sign-on solution, available as aRed Hat JBoss Middleware for OpenShift containerized image. The Red HatSingle Sign-On for OpenShift image provides an authentication server thatyou can use to log in centrally, log out, and register. You can also manageuser accounts for web applications, mobile applications, and RESTful webservices.This erratum releases a new image for Red Hat Single Sign-On 7.6.14 foruse within the OpenShift Container Platform 3.10, OpenShift Container Platform3.11, and within the OpenShift Container Platform 4.3 cloud computingPlatform-as-a-Service (PaaS) for on-premise or private cloud deployments,aligning with the standalone product release. This security update has moderateimpact.Security fixes: Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Red Hat Single Sign-On for OpenShiftto a version that resolves this vulnerability.Fixed in 7.6.14
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is described as an unauthenticated account takeover through a bypass in the reset-credentials flow. An attacker does not need to authenticate before exploiting the affected flow.
Which deployments are in scope for this update?
The updated Red Hat Single Sign-On 7.6.14 image is intended for use on OpenShift Container Platform 3.10, 3.11, and 4.3, including on-premise or private-cloud PaaS deployments. The listed affected OpenShift offerings include standard OpenShift Container Platform, Power, and IBM Z and LinuxONE variants.
How can I determine whether my environment needs remediation?
Check whether you run the Red Hat Single Sign-On for OpenShift container image and expose or use its reset-credentials flow on a supported OpenShift deployment. The erratum provides a new 7.6.14 image aligned with the standalone product release.