EM-20261105-RH12 VulnerabilityHigh severity

Keycloak Vulnerability (CVE-2026-103112)

CVE-2026-103112

Status

Developing

Since Nov 05 17:17 UTC: signals keep joining.

First Signal: Nov 05 00:00 UTCC41 Red Hat Security Data
Page Born: Nov 05 17:17 UTCsecond source joined
Last Signal: Nov 05 17:17 UTC12 hours before snapshot
Sources: 21 official · 1 research, news or crowd
Open For: 25 hoursso far

Life Of This Page

1
Born

Nov 05 17:17 UTC
A second, independent source names it.
2
Developing · Now

Nov 05 17:17 UTC
New signals join; severity can move.
3
Confirmed

Not yet
CISA KEV lists it, or exploitation in the wild is reported.
4
Resolved

Not yet
Past the fix deadline and 14 days with no new signal.
5
Archived

Not yet
30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The ID never changes, and earlier addresses keep working. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

Disclosed: reached

Nov 05 17:17 UTC
C6 NVD published
Scored: reached

Nov 05 17:17 UTC
CVSS 7.5
Exploited: not yet

Not yet
No exploitation reported
Advisories: not yet

Not yet
None yet
Vendor Response: reached

Nov 05 00:00 UTC
C41 published
Resolved: not yet

Not yet
After 14 quiet days

Timeline

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

Nov 05 17:17 UTCCVE-2026-103112 (CVSS 7.5) (opens source in a new tab) A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow… High severityDatabaseC6 NVD CVE API 2.0
Nov 05 00:00 UTCRed Hat: CVE-2026-103112 (important) (opens source in a new tab) High severityVendorC41 Red Hat Security Data