CVE-2026-125652
Keycloak-services: keycloak-services: client-level mandatory pkce bypass via login-actions entry point
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier.
| CWE | CWE-862 |
| Vendor | red hat |
| Product | red hat build of keycloak |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat build of keycloak
Be the first to know when new medium vulnerabilities affecting red hat red hat build of keycloak are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
Red Hat / Red Hat Build of Keycloak
All versions affected Red Hat / Red Hat Build of Keycloak
All versions affected Red Hat / Red Hat Single Sign-On 7
All versions affected Red Hat / Red Hat Single Sign-On 7
All versions affected References
Credits
Red Hat would like to thank Adel Assakaf (Oteria) for reporting this issue.