Package
keycloak-26.5
Component
keycloak-services
Latest update
Fixed version
26.5.7-r6
9.1
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
26.5.7-r6Impact
Fixed via cherry-pick of the upstream patch from the release/26.4 branch (GHSA-4gv3-mc9p-5wqc), since this release branch has no patched version of its own. The fix binds the authentication-selector-screen state to the specific authenticator ID rather than a boolean flag, closing the unauthenticated account-takeover bypass in the reset-credentials flow.
Status
Impact
This package is no longer supported upstream and has reached its end of life. A version upgrade is required to fix this vulnerability.
Status