CVE-2026-125652 | BDVDB-2026-402773 Detail

Description#

A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and authorization logic for the identity provider. The issue occurs when a user initiates a login after visiting the password reset page, causing the system to skip mandatory security checks for Proof Key for Code Exchange (PKCE). This could allow an attacker who intercepts a login code to gain unauthorized access to the user's account without needing the required security verifier.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-10Record published in the CVE List.