Keycloak Reset-Credentials Flaw: Urgent Security Update Needed
- Severity
- HIGH
- Affected component
- keycloak (npm)
- Patched version
- Not yet available
An unauthenticated account takeover vulnerability has been reported in Keycloak's reset-credentials flow. Users of the keycloak npm package should take immediate action.
What happened
An early warning has been issued regarding a high-severity vulnerability in the reset-credentials flow of the keycloak-services component. This flaw reportedly allows an unauthenticated attacker to force the password reset process for any user without requiring the victim to click the email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials. The vulnerability is currently under investigation and no authoritative version range has been published.
The flaw was first flagged on 2026-08-18T18:32:00+00:00. It is not yet confirmed to be exploited in the wild. The affected component is the keycloak npm package. Users of this package should review any recent password resets for suspicious activity and consider upgrading to the latest version of keycloak as a precaution.
What to do about it
- Upgrade to the latest version of keycloak as soon as possible.
- Review any recent password resets for suspicious activity.
- Monitor the primary sources for updates on this vulnerability.
- No official fix has been published yet. Continue to monitor the sources below for updates.
How 0Day would have caught this
keycloak is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the keycloak npm package, you may be affected. No authoritative version range has been published yet.
What should I do right now?
Upgrade to the latest version of keycloak and review any recent password resets for suspicious activity.
Has this been exploited in the wild?
There is no confirmed evidence that this vulnerability has been exploited in the wild. It is under investigation.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the sources below for updates.