RHSA-2026:99766 - Security Advisory

Topic

New Red Hat Single Sign-On 7.6.14 packages are now available for Red Hat
Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of
none. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak
project, that provides authentication and standards-based single sign-on
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.6.14 on RHEL 9 serves as a replacement
for Red Hat Single Sign-On 7.6.13, and includes bug fixes and enhancements,
which are documented in the Release Notes document linked to in the References.

Security Fix(es):

• Unauthenticated account takeover via reset-credentials flow bypass (CVE-2026-18963)

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Single Sign-On 7.6 for RHEL 9 x86_64

Fixes

CVEs

• CVE-2026-18963

References

• https://access.redhat.com/security/updates/classification/#critical