Summary
A vulnerability in the authentication and credential recovery process may allow an unauthenticated attacker to bypass intended verification controls during password reset operations. By exploiting this weakness, an attacker could reset credentials for arbitrary user accounts and gain unauthorized access without possessing valid authentication credentials.
Impact
Successful exploitation could lead to unauthorized account takeover and access to application resources with the privileges of the compromised user. Depending on the affected account's permissions, this may result in unauthorized access to sensitive information, misuse of privileged functions, modification of system settings, or broader compromise of the affected environment.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| Building Cloud Services | vers:semver/>=7.19|<7.36.156 |
Vulnerabilities
Expand / Collapse allA flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Remediation
The vulnerability was remediated in the Building Cloud Service on August 26, and as the service is centrally managed and updated automatically, no customer action is required to apply the security fix. Customers are advised to review user account activity and verify that no passwords have been changed unexpectedly prior to remediation.
Acknowledgments
WAGO GmbH & Co. KG thanks the following parties for their efforts:
- CERTVDE for coordination (see https://certvde.com )
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 04.11.2026 14:00 | Initial release. |