Keycloak 26.4.x < 26.4.15 / 26.6.x < 26.6.6 Unauthenticated Account Takeover

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338317);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/20");

  script_cve_id("CVE-2026-18963");

  script_name(english:"Keycloak 26.4.x < 26.4.15 / 26.6.x < 26.6.6 Unauthenticated Account Takeover");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an account takeover vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Keycloak installed on the remote host is 26.4.x prior to 26.4.15, or 26.6.x prior to 26.6.6. It is,
therefore, affected by a vulnerability:

  - A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core
    engine for identity and access management. The issue allows an unauthenticated attacker to force the
    password reset process for any user without needing to click the required email verification link. This
    can result in the attacker gaining full control over target user accounts by directly setting new
    credentials. (CVE-2026-18963)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2026:56519");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2026:56520");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2026:56523");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2026:56524");
  script_set_attribute(attribute:"see_also", value:"https://access.redhat.com/security/cve/CVE-2026-18963");
  script_set_attribute(attribute:"solution", value:
"Upgrade Keycloak to version 26.4.15 / 26.6.6 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-18963");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:keycloak:keycloak");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("keycloak_nix_installed.nbin");
  script_require_keys("Host/local_checks_enabled", "Host/uname", "installed_sw/Keycloak");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Keycloak', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '26.4.0', 'fixed_version': '26.4.15'},
        {'min_version': '26.6.0', 'fixed_version': '26.6.6'}
      ]
    }
  ]
};

var res = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:res);