RHSA-2026:99763 - Security Advisory

Topic

A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.6.14 serves as a replacement for Red
Hat Single Sign-On 7.6.13, and includes bug fixes and enhancements, which are
documented in the Release Notes document linked to in the References.

Security Fix(es):

• Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)

Solution

Before applying the update, back up your existing installation, including all
applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in
to download the update).

Affected Products

• Red Hat Single Sign-On Text-Only Advisories x86_64

Fixes

CVEs

• CVE-2026-18963

References

• https://access.redhat.com/security/updates/classification/#critical