Security Advisory catalog CVE-2026-94001
cve-program · CVE-2026-94001 Published
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-94001 Published rhbk/keycloak-operator-bundle https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-operator-bundle",
"defaultStatus": "affected",
"versions": [
{
"version": "26.6.8-2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
]
} rhbk/keycloak-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "26.6-24",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
]
} rhbk/keycloak-rhel9-operator https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhbk/keycloak-rhel9-operator",
"defaultStatus": "affected",
"versions": [
{
"version": "26.6-24",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
]
} keycloak/rhbk-openshift-rhel9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6.8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"packageName": "keycloak/rhbk-openshift-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
]
} keycloak-services https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6.8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
]
} rhbk/keycloak-rhel9 https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat build of Keycloak 26.6.8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected",
"packageName": "rhbk/keycloak-rhel9",
"cpes": [
"cpe:/a:redhat:build_keycloak:26.6::el9"
]
} keycloak-services https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "keycloak-services",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
]
} Original source record · Cite this exact observation · Complete original publisher JSON