Session Handling Flaw in Keycloak's Authentication Flow

CVE-2026-103112

What is CVE-2026-103112?

A security issue in the keycloak-services component of Keycloak allows attackers to exploit authentication session handling. This flaw arises when the system fails to properly verify the validity of authenticators during transitions between the standard authentication path and the credential reset process. An attacker can leverage this vulnerability by creating a race condition during the credential reset phase, which may enable them to associate their authenticated state with that of another user's session. If successful, this could allow the attacker to gain full control of the victim's account, including the ability to change passwords and sensitive information.

References