https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:13:22 +0000 https://cve.radiocsirt.org/vuln/4jde002044 <p>ABB is aware of public reports of a vulnerability in the product listed as affected in the advisory. An update has been deployed to the cloud system that resolves a publicly reported vulnerability in the product versions listed above.</p> <p>An attacker who successfully exploited this vulnerability could take remote control of the product.</p> <p>The vulnerability has been identified in the keycloak authentication component which is integrated into dynovaPRO™. The vulnerability exists in the &#39;Forgot Password&#39; functionality and allows unauthenticated attackers to bypass authentication and hijack user accounts.</p> <p>Users who have received a password reset mail before the mentioned date, without having requested it, are thereby potentially attacked by exploiting this vulnerability.</p> <p>ABB investigated potentially malicious user reset activities and blocked those user access immediately to reduce the exploitation risk. The credentials of those users have been deleted after the software fix was deployed and the users were informed that they must reset their password to gain access to dynovaPRO™ again.</p> <p>ABB is aware of public reports of a vulnerability in the product listed as affected in the advisory. An update has been deployed to the cloud system that resolves a publicly reported vulnerability in the product versions listed above.</p> <p>An attacker who successfully exploited this vulnerability could take remote control of the product.</p> <p>The vulnerability has been identified in the keycloak authentication component which is integrated into dynovaPRO™. The vulnerability exists in the &#39;Forgot Password&#39; functionality and allows unauthenticated attackers to bypass authentication and hijack user accounts.</p> <p>Users who have received a password reset mail before the mentioned date, without having requested it, are thereby potentially attacked by exploiting this vulnerability.</p> <p>ABB investigated potentially malicious user reset activities and blocked those user access immediately to reduce the exploitation risk. The credentials of those users have been deleted after the software fix was deployed and the users were informed that they must reset their password to gain access to dynovaPRO™ again.</p> https://cve.radiocsirt.org/vuln/4jde002044 https://cve.radiocsirt.org/vuln/bdu:2026-12649 bdu:2026-12649 https://cve.radiocsirt.org/vuln/bdu:2026-12649 https://cve.radiocsirt.org/vuln/bit-keycloak-2026-18963 <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.</p> <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.</p> https://cve.radiocsirt.org/vuln/bit-keycloak-2026-18963 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1078 certfr-2026-avi-1078 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1078 https://cve.radiocsirt.org/vuln/euvd-2026-364640 EUVD-2026-364640 https://cve.radiocsirt.org/vuln/euvd-2026-364640 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18963 <p>A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.</p> <p>A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18963 https://cve.radiocsirt.org/vuln/ghsa-4gv3-mc9p-5wqc <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-services</p> <p>A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.</p> <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-services</p> <p>A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.</p> https://cve.radiocsirt.org/vuln/ghsa-4gv3-mc9p-5wqc https://cve.radiocsirt.org/vuln/icsa-26-265-06 <p>Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification.</p> <p>Siemens has released new versions for the affected products and recommends to update to the latest versions.</p> <p>Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification.</p> <p>Siemens has released new versions for the affected products and recommends to update to the latest versions.</p> https://cve.radiocsirt.org/vuln/icsa-26-265-06 https://cve.radiocsirt.org/vuln/ncsc-2026-0326 NCSC-2026-0326 https://cve.radiocsirt.org/vuln/ncsc-2026-0326 https://cve.radiocsirt.org/vuln/rhsa-2026:56519 <p>keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass</p> <p>keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass</p> https://cve.radiocsirt.org/vuln/rhsa-2026:56519 https://cve.radiocsirt.org/vuln/ssa-503852 <p>Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification.</p> <p>Siemens has released new versions for the affected products and recommends to update to the latest versions.</p> <p>Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification.</p> <p>Siemens has released new versions for the affected products and recommends to update to the latest versions.</p> https://cve.radiocsirt.org/vuln/ssa-503852 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2915 <p>Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Benutzerkonten zu übernehmen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen und dadurch Benutzerkonten zu übernehmen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2915