The flaw exists in the reset‑credentials flow within the Keycloak‑services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. An unauthenticated attacker can trigger the password reset process for any user without the required email verification link. This allows the attacker to set new credentials and gain full control over the target account, compromising confidentiality, integrity, and availability of the affected systems.

The vulnerability affects Red Hat Build of Keycloak, Red Hat JBoss Enterprise Application Platform Expansion Pack, and Red Hat Single Sign‑On 7. No specific version information is listed in the advisory, so all installed builds of these products should be evaluated for the presence of the fix.

With a CVSS score of 9.1 the flaw is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. However, the attack vector is an unauthenticated web request to the reset‑credentials endpoint, which can be performed by anyone with network access to the Keycloak Services component. If exploited, an attacker can take over any user account without user interaction, making this a critical risk for organizations using these Red Hat products.