Red Hat

CVE-2026-125652: A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The i

CVE-2026-125652 Nov 10, 2026 Source: Vendor

In brief. Red Hat published CVE-2026-125652: A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The i on November 10, 2026. It credits 1 researcher or team for 1 CVE.

A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-125652

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1 line

Showing 1–1 of 1 matching , clear filters

CVE-2026-125652 BR2026-0000-044175 unclaimed

Credited as Red Hat would like to thank Adel Assakaf (Oteria) for reporting this issue