Issued:: 2026-08-18
Updated:: 2026-08-18

RHSA-2026:56520 - Critical: Red Hat build of Keycloak 26.4.15 Security Update

Synopsis

Critical: Red Hat build of Keycloak 26.4.15 Security Update

Type/Severity

Security Advisory: Critical

Topic

New Red Hat build of Keycloak 26.4.15 packages are available from the Customer Portal

Description

Red Hat build of Keycloak 26.4.15 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

Security fixes:

Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Affected Products

Product	Version	Arch
Red Hat build of Keycloak	Text-only Advisories	x86_64

Fixes

(none)

CVEs

CVE-2026-18963

References

https://access.redhat.com/security/updates/classification/#critical

Additional information

The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at Security Contacts and Procedures.
Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.