Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

Keycloak 26.7.2 unauthenticated account takeover exploit published

Original title: [webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover

Exploit-DB ()1 · 1 read
Read at exploit-db.com
AI summary · x-ai/grok-4.7Summaries by Vani AI

Exploit-DB lists a web-app exploit that takes over accounts in Keycloak 26.7.2 without authentication.

A public Exploit-DB entry describes unauthenticated account takeover against Keycloak 26.7.2 and classifies it as a web application issue. The short listing does not name a CVE, a fixed version, or confirmed attacks.

Unconfirmed: Whether a fix exists or attackers are using the issue is not stated.

Key facts
  • The listed product version is Keycloak 26.7.2.
  • The title says the takeover requires no authentication.
  • No patch or vendor advisory is included in the snippet.
Security assessment · AI, from the articlePublic proof of concept

Impact: unauthenticated account takeover

ProductAffected
Keycloak26.7.2
What to do
  1. 1.Identify deployments running Keycloak 26.7.2 and review the published exploit listing.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
keycloakaccount-takeoverwebappsexploit-db
Products
Keycloak

From the original article

Exploit-DB

exploit-db.com

Read the full article at Exploit-DB

This source shares headlines only. Summary, key facts and assessment above are AI-written from the article and can be wrong.